@thesamesam @lanodan @dalias @mirabilos Hmm, I am not familiar with too many build engines in the OSS area, but the one I frequent (openSUSE build service) disables any network connection during the build itself. If a package needs something fetched from the Internet before the build starts, it must declare it, and the downloaded artefacts become part of the build archive/documentation.