--- title: Who Built This? | daily.dev description: A deep survey of how different language ecosystems and package managers handle VCS stamping — embedding the source commit hash into built artifacts. Go does... canonical: https://daily.dev/posts/who-built-this--bc4rx6op2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Who Built This? | daily.dev og:description: A deep survey of how different language ecosystems and package managers handle VCS stamping — embedding the source commit hash into built artifacts. Go does... og:url: https://daily.dev/posts/who-built-this--bc4rx6op2 og:image: https://api.daily.dev/og/posts/Bc4rx6Op2.png og:image:alt: Who Built This? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Who Built This? **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 9 min read · 0 upvotes · 0 comments ## Summary A deep survey of how different language ecosystems and package managers handle VCS stamping — embedding the source commit hash into built artifacts. Go does this automatically since 1.18; Rust requires opt-in build scripts; .NET has mature tooling via SourceLink; Java relies on Maven/Gradle plugins; PHP's Composer preserves commit SHAs by default. Interpreted languages generally lose VCS metadata at publish time, while system package managers like dpkg and RPM rarely propagate it. OCI container images have an annotation spec for this but it's inconsistently used. The post also covers git archive's export-subst mechanism, trusted publishing via Sigstore as a registry-side alternative, and how reliable stamping metadata could enable richer dependency tooling like checking out the exact upstream commit your installed package was built from. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Stamp It\! All Programs Must Report Their Version](https://daily.dev/posts/stamp-it-all-programs-must-report-their-version-cyblih53k) · Lobsters · 0 upvotes · 0 comments - [You don’t know what you’re actually shipping](https://daily.dev/posts/you-don-t-know-what-you-re-actually-shipping-sitrszuhz) · All Things Open · 0 upvotes · 0 comments - [What's new in git-pkgs](https://daily.dev/posts/what-s-new-in-git-pkgs-emtpxalx0) · Andrew Nesbitt · 0 upvotes · 0 comments - [Software Supply Chain Security: Why 99% of Your Container is Mystery Code](https://daily.dev/posts/software-supply-chain-security-why-99-of-your-container-is-mystery-code-0o8ohjmsz) · Cloud Native Now · 0 upvotes · 0 comments - [Vouch for an open source web of trust \(Changelog News \#180\)](https://daily.dev/posts/vouch-for-an-open-source-web-of-trust-changelog-news-180--zqq2buyj3) · Changelog · 3 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#rust](https://daily.dev/tags/rust), [#version-control](https://daily.dev/tags/version-control) [View this post on daily.dev](https://daily.dev/posts/who-built-this--bc4rx6op2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Who Built This?","url":"https://daily.dev/posts/who-built-this--bc4rx6op2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/who-built-this--bc4rx6op2"},"datePublished":"2026-04-07T10:39:19.836Z","dateModified":"2026-04-07T10:39:49.018Z","description":"A deep survey of how different language ecosystems and package managers handle VCS stamping — embedding the source commit hash into built artifacts. Go does...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/who-built-this--bc4rx6op2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang,rust,version-control","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"Who Built This?"}]} ```