we are about to set up a production build server to maintain a embedded linux product. I know that I can specify a package version with PREFERRED_VERSION_<package> inside the recipe, but this may take a lot of time to lock every single tool in the image (i.e. grep, strace, ecc). This will be useful in case we need to rebuild the server (we could backup the whole server, but this wont be traced. Even commit everything to a git repo seems to be not so clever, correct me if I'm wrong).
Is there a way to get something like package-lock.json or an image footprint?
EDIT
What I'd like to achieve is a list of
PREFERRED_VERSION_<package0> = "xxx"
...
PREFERRED_VERSION_<packageN> = "xxx"
that I can use to replicate the image on a clear system (without any cached file). It seems that there is no such command to do that directly, instead it's possible to get a list of image packages and version by
bitbake <image> -s
and with a simple script generates what I'm looking for.