My "reproducible" build kept returning the same hash after the code changed. That was the bug.

TL;DR: I built ZeroTrust — a supply-chain security scanner, zero third-party dependencies, go.mod...