of distros, they usually refer to an upstream by hash https://src.fedoraproject.org/rpms/conky/blob/rawhide/f/sources https://src.fedoraproject.org/rpms/conky/

of distros, they usually refer to an upstream by hash https://src.fedoraproject.org/rpms/conky/blob/rawhide/f/sources https://src.fedoraproject.org/rpms/conky/blob/rawhide/f/sour... also of flathub https://github.com/flathub/com.belmoussaoui.ashpd.demo/blob/bf73e97322c7130a023b1d81fe5b8d766bffe492/com.belmoussaoui.ashpd.demo.json#L62 https://github.com/flathub/com.belmoussaoui.ashpd.demo/blob/... "they are not lockfiles!" is a debatable separate topic, but for a wider disconnected ecosystem of sources, you can't really rely on versions being useful for reproducibility