External git dependencies without pinned versions causes non-deterministic builds

[anshul23102]

Description

The workspace dependencies include external crates fetched from git without specifying branch, tag, or rev constraints: mohu-compute and mohu-linalg. This means each build may fetch different commits from the default branch, causing non-deterministic builds and dependency conflicts. Without version pinning, the project cannot guarantee reproducible builds or consistent behavior across different build environments.

Steps to Reproduce

1. Run 'cargo build' on main branch
2. Observe that mohu-compute and mohu-linalg are fetched from git
3. Wait for commits to be merged in those repositories
4. Run 'cargo build' again
5. Different commits may be fetched, causing non-deterministic builds

Environment Information

• mohu (Rust library)
• Affected file: Cargo.toml, lines 73-74
• External dependencies: mohu-compute, mohu-linalg from GitHub
• No version pinning specified

Expected Behavior

Git dependencies should specify explicit commits (rev=) or tags to ensure reproducible builds. Alternatively, crates should be published to crates.io and version-pinned via version constraints.

Actual Behavior

Lines 73-74 specify git repositories without branch, tag, or rev constraints. Cargo will fetch the default branch (main/master) which changes over time.

Code Reference

File: Cargo.toml
Lines: 73-74
Problematic code: mohu-compute = { git = 'https://github.com/mohu-org/mohu-compute' }
mohu-linalg = { git = 'https://github.com/mohu-org/mohu-linalg' }

Additional Context

Severity: Medium. Non-deterministic builds can hide bugs, cause CI/CD failures, and make debugging difficult. Suggested fix: Pin to specific commits or tags: { git = 'https://...', rev = 'abc123...' } or publish to crates.io.

Suggested Labels

build, dependency-management, reproducibility

---

Program Template

• GSSoC

[anshul23102]

@mohu-org
/assign

[amritbej]

Please assign it to me .

[aishwaryagangaraj-web]

Hi @maintainers,

I'm interested in contributing to this issue. I noticed it has already been requested by other contributors, so I'll defer to them. If it becomes available later, I'd be happy to work on it.

Thank you!

[anshul23102]

Hi @mohu-org maintainers, I'd like to request assignment for this issue under GSSoC 2026. /assign /claim

[Tenisha5132]

/assign
/claim
i want to work on this issue

[github-actions]

Usage: /assign. Contributors can only assign themselves.

[bhavyajain0810]

/assign

[github-actions]

Assigned to @bhavyajain0810.

[ritikj17]

/assign

[github-actions]

This issue is already assigned to @bhavyajain0810.