Comment by kazinator

The right way to do this is not to rely on the git hashes, but to hash the inputs into the configuration system (those that are in version control, not the implicit environmental inputs from the platform).

For instance, if the only input to the configuration system is the body of the configure script, then we hash that. That is then our key to the generated materials.