title: Ensuring reproducible builds using NuGet packages
body: <p>I have a .NET app called <code>Application</code>.</p>
  
  <p>This application depends on two NuGet packages:</p>
  
  <ul>
  <li><code>Database</code>, version 2.*</li>
  <li><code>Logging</code>, version 3.*</li>
  </ul>
  
  <p>The <code>Database</code> package depends on two additional packages:</p>
  
  <ul>
  <li><code>DTO</code>, version 1.*</li>
  <li><code>DAL</code>, version 4.*</li>
  </ul>
  
  <p>Currently, <code>Application</code> uses these concrete package versions: <code>Database</code> version 2.1, <code>Logging</code> version 3.1.</p>
  
  <p>I build my <code>Application</code>, NuGet resolves and downloads the dependencies, so I get <code>DTO</code> version 1.5 and <code>DAL</code> version 4.0. I put my <code>Application</code> into an installation package and deliver to my customer. I tag this release in git with <code>app-1.0</code>.</p>
  
  <p>So my customer gets the following binaries:</p>
  
  <ul>
  <li><code>Application.exe</code>, version 1.0</li>
  <li><code>Database.dll</code>, version 2.1</li>
  <li><code>Logging.dll</code>, version 3.1</li>
  <li><code>DTO.dll</code>, version 1.5</li>
  <li><code>DAL.dll</code>, version 4.0</li>
  </ul>
  
  <p>One year later, the customer files a bug which I need to thoroughly analyse. To reproduce the issue, I need the same binaries as the customer, so I check out the tag <code>app-1.0</code> and want to build my application.</p>
  
  <p>Meanwhile, the <code>DAL</code> and the <code>DTO</code> packages were updated on the NuGet feed: latest <code>DTO</code> version is 1.7 and <code>DAL</code> version is 4.5.</p>
  
  <p>My questions are:</p>
  
  <ul>
  <li>When I build my application now, does NuGet resolve the <code>Database</code> dependencies to the latest available versions? So do I get <code>DTO 1.7</code> and <code>DAL 4.5</code> instead of <code>DTO 1.5</code> and <code>DAL 4.0</code> (which were used to build <code>app-1.0</code>)?</li>
  <li>If yes, how can I ensure the binary reproducibility of my release using NuGet?</li>
  <li>If no, how does NuGet manage to resolve the "right" references?</li>
  </ul>