The vast majority of projects used in our Yocto project are OSS and pulled from the web.

I need to guarantee to be able to rebuild exactly the releases we create for our product.

So relying on 3rd party repos to still be there in X years or to not have been tampered with after a release is not a viable option.

It seems to me the only way to achieve this is by keeping the download directory (DL_DIR) and the sstate_cache that was created during the build.

Does this make sense or am I missing something?
Do I need both or is the DL_DIR sufficient?
Is it possible to bake an image with the content of the DL_DIR, no sstate_cache and no internet? (This one I can test myself but would be good to know if this is a valid use case)