[rtpg]

checksums are a thing, as well as package mirrors or outright holding onto the file and checking in a binary.

There's loads of ways to know what you are using without needing to strip mtime's from zip files.

[zaphar]

Checksums, solve a different problem. How does a developer know his code which works on his laptop will work on production. One of, but not the only, conditions for that are that his development artifact builds with the same dependencies as it will build in production. Their are a lot of possible causes for Dev/Prod to differ wildly. One of them are poor build practices.