Interesting concept for verifying mom packages are built from public commits link.medium.com/7UQaeWkyiT