Awesome. Great to see the "control the inputs, control the outputs; gain repeatability, gain control" mantra finally moving into the package management and dependency world. If Haskell's next generation of tooling lands hashes and built-in end-to-end integrity as a first class citizen, afaict that'll make Haskell be one of the first communities to really permanently address the "it built on tuesday" problem... and hopefully far from the last :)