but doing anything stronger, ie (committing a fingerprint to the repo as bazel does) requires fully declaring transitive deps