Debian has been working towards reproducible builds [1]. What this means is that the package maintainer is unable to alter the binary/package outside of the pu

Debian has been working towards reproducible builds [1]. What this means is that the package maintainer is unable to alter the binary/package outside of the publicly available sources. In the case of the web extension, the maintainer could build whatever software they wanted, not necessarily the source you see on github or elsewhere. A reproducible build system would prevent this type of attack (that I'm talking about here). 1: https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds