Even beyond that, we need to be able to prove that the binaries we're distributing were made from the source that we claim they are, and be able to provide exac

Even beyond that, we need to be able to prove that the binaries we're distributing were made from the source that we claim they are, and be able to provide exact instructions for a customer to independently re-create the binaries. That usually means that we stick to versions of libraries and compilers that are on the GA installation disks for a system, with exceptions made for a few security-critical libraries like OpenSSL.