Comment by amluto

> Fundamentally: There is no way to lock webapps to reproducible builds.

One could absolutely use subresource integrity to lock one’s reference to a vendor’s subresource to a specific version. That’s what it’s there for.