> That can make getting code into those repos a bit cumbersome, but that's kind of the price you pay. That's as clear a statement of security theater as I can

> That can make getting code into those repos a bit cumbersome, but that's kind of the price you pay. That's as clear a statement of security theater as I can think of. If you make it cumbersome to build packages for a distro and get them accepted into that distro, your distro then ends up with language-level package managers doing an end-run around that "secure" package-managing apparatus. Meanwhile, non-dilettante security experts are sandboxing the code that they aren't able to verify. Chrome/Chromium does that. Firefox is doing that more and more. What are the cumbersome-package-having distros doing?