I've been using https://github.com/stacklok/frizbee to lock down to commit hash. I wonder how this tool compares to that.