software provenance

Same commit, two builds, checksums that disagree

A commit hash guarantees the repository, not the software. How build pipelines resolve trust once at the reference and inherit it against changed content.