I worked for 20 years in an ecosystem that didn’t have lockfiles and had reproducible builds before the term was invented, and now you come and tell me that it couldn’t be?

Where did the packages come from? How did you know they hadn’t been changed at the bit-level since last time?