The report should contain the SHA of the actual sources it was generated from.
The report should contain the SHA of the actual sources it was generated from.