davad

I think they did say that in the older thread. But for proper security, you shouldn’t have to trust them. You should have build tools that will re-fetch everything to create an identical build. That gives a clear chain of custody, which proves that morning has been tampered with.

It sounds like most, if not all, come from upstream projects.

I love the idea, but I don’t believe the timeline.