The generate_modulemd_with_hashes.sh script can generate a modulemd with commit hashes for every component, reflecting the repodata it uses. Doing it this way makes the builds much more reproducible, as we use the same thing we are resolving against
Packages with epoch doesn't get hash with this script. It needs to get stripped before asking koji for the hash.
The regexp on this link can be used: https://github.com/fedora-modularity/baseruntime-package-lists/blob/master/make_modulemd.pl#L79