> is useful for a distributed community but does seem like a stretch for the amount of work going in to reproducible builds Good point but even in the case of

> is useful for a distributed community but does seem like a stretch for the amount of work going in to reproducible builds Good point but even in the case of a larger monolithic systems you want to be sure it is possible to forensically analyze your source, to audit it. Once you can trust that one hash relates to this specific thing you can sign it, etc. This can then be "sold" with some added value of trust down the stream. Tracking of hashes also becomes easier once they are reproducible because they mean much more than just a "version".