> conversely, relying on a git tag of "v1.2.3" from a random Github repo could be anything at any point. I don't know of a single modern build tool that can do

> conversely, relying on a git tag of "v1.2.3" from a random Github repo could be anything at any point. I don't know of a single modern build tool that can do this but doesn't require or record this information specifically? Maybe the earlier versions of Go? (I know they've gone through a few changes in module/import strategies.)