suggest using docker image digest

neps/nep-0330.md

@@ -56,7 +56,7 @@ type Standard {
 }
 
 type BuildInfo {
-    build_environment: string, // reference to a reproducible build environment docker image, e.g. "sourcescan/cargo-near@sha256:bf488476d9c4e49e36862bbdef2c595f88d34a295fd551cc65dc291553849471" or something else pointing to the build environment.
+    build_environment: string, // reference to a reproducible build environment docker image, e.g. "sourcescan/cargo-near@sha256:bf488476d9c4e49e36862bbdef2c595f88d34a295fd551cc65dc291553849471" or something else pointing to the build environment. When using a Docker image as a reference, it's important to specify the digest of the image to ensure reproducibility, since a tag could be reassigned to a different image.
     source_code_snapshot: string, // reference to the source code snapshot that was used to build the contract, e.g. "git+https://github.com/near-DevHub/neardevhub-contract.git#335e89edec95d56a4744e7160c3fd590e41ec38e" or "ipfs://<ipfs-hash>"
     contract_path: string|null, // relative path to contract folder within the source code e.g. "src/contract". Often, it is the root of the repository, so can be omitted. 
     build_command: string[], // the exact command that was used to build the contract, with all the flags e.g. ["cargo", "near", "build", "no-abi"].