1. A method comprising: generating for a particular software deployment, a first signature as a function of digest information that identifies a plurality of deployed source components for the particular software deployment; storing mapping data that maps the first signature to the digest information that identifies the plurality of deployed source components for the particular software deployment; generating a second signature based on information that defines target source components for a set of software deployments that includes the particular software deployment; determining whether the deployed source components satisfy the target source components by comparing the first signature with the second signature; storing an indication of whether the deployed source components satisfy the target source components.