Most isn't enough. "All?" with a question mark isn't enough. Just like one zero-day is enough to totally compromise a system, one unverified source anywhere i

Most isn't enough. "All?" with a question mark isn't enough. Just like one zero-day is enough to totally compromise a system, one unverified source anywhere in a build dependency tree is a great way to land just one RCE, leaving your system precisely as hosed as if you just got hit with a zero-day. :) I saw another blog about the summit the top link reports on discuss this as well -- from https://garbas.si/2016/reproducible-builds-summit-in-berlin.html https://garbas.si/2016/reproducible-builds-summit-in-berlin.... : > As with zero vulnerability days, there should probably be zero reproducibility days.