Any commentary on Reproducible Builds should probably include a description of the Google method, i.e. copying all dependencies into your repo, and doing regular pulls to get upstream changes.