Manifest.toml committed but production resolves different binary artifacts across architectures

The Resolution Mechanism

The Manifest.toml records the package version and the git-tree-sha1 of the Julia wrapper code, but it does not pin a single global binary artifact hash. For JLL packages (e.g., OpenBLAS_jll), the Julia package is merely a thin wrapper that utilizes BinaryWrappers.jl to resolve the actual binary dependency at instantiation time.

When Pkg.instantiate() runs, Julia detects the host's CPU architecture and OS. It then queries the artifact metadata associated with that specific package version to find the matching artifact ID for the current platform. Consequently, the same Manifest.toml will resolve to an ARM64 artifact on Apple Silicon and an x86_64 artifact on Linux. This is intended behavior: a binary compiled for x86_64 cannot execute on ARM64.

Explanation of Observed Behavior

• Git-tree-sha1: This refers to the source code of the JLL wrapper package. Since the wrapper code is identical across platforms, this hash should remain consistent. If Pkg.status() shows different hashes for the same version, it typically indicates the packages are being resolved from different registry snapshots or versions, though the binary artifacts themselves will always differ by architecture.
• Artifact Selection: The selection happens via a lookup table within the package's metadata. The manifest ensures you have the same wrapper version, and that wrapper ensures you get the correct binary for your hardware.

Workflow for Consistent Dependencies

It is impossible to have bit-for-bit identical binary dependencies across different CPU architectures because the machine code must differ. However, to guarantee the most stable and reproducible environment possible across architectures using the General registry, follow these steps:

1. Commit the Manifest: Continue committing Manifest.toml to ensure all environments use the same versions of the wrapper packages.
2. Pin Julia Version: Ensure the exact Julia version (e.g., 1.10.x) is identical across environments to avoid differences in the BinaryWrappers logic.
3. Use Clean Containers: Use Pkg.instantiate(project=.) in a fresh environment to prevent local state from polluting the resolution.
4. Verify via Artifacts: To confirm which binaries are actually being used, inspect the artifacts directory:

   # Example path to check resolved artifacts
   ls ~/.julia/artifacts

Diagnostic Request

To determine if the differing git-tree-sha1 values are an anomaly or expected, please provide the output of Pkg.status() for one specific JLL package from both environments, including the full version string.