> I think a big problem is you grab a library and you really have no idea what you've gotten. Maybe it has a label. It says it's 1.2, but you don't know which functions inside it have changed, or why. You don't actually know what you're running. And maybe the jar file or artifact tells you something about the source that was used to produce it, but the process that was used to produce it is often opaque. And any of that could be wrong because there's a lot of human steps involved in producing artifacts. And because so many people use Git, I'd like to get closer to leveraging some of the features there, in particular using SHA's and content-based addressing to talk about things.
> I had worked on a library called Codeq, which we'll have a new version of soon, that sort of extends the Git model down to the function level, so you would have SHA's for individual functions, and you could have dependencies on functions, instead of on artifacts. So a lot of work is happening around that, and some of that manifests itself in this dependency tool.