A binary crate should pin its dependency graph: without the lockfile in git, source and snap builds float transitive versions, so a 0.1.0 artifact rebuilt later would not be the same binary.
