>It is also simply not sufficient to say "here is a repository with a lot of code in it": you have to be able to specify what exact code was used for the build

Does the LGPL really specify that? IIRC the license is pretty vague and that seems way too specific to hold up in court.