True, but this requires the source you build not to have been gone through the build server, which is reasonable. The thing is you can circumvent this by attac

True, but this requires the source you build not to have been gone through the build server, which is reasonable. The thing is you can circumvent this by attacking the version control and/or developer systems. And at least the later one are often massively vulnerable to certain kind of supply chain attacks. Ironically the permissions and setups commonly used for a nice development flow are also making systems vulnerable for many kinds of supply chain attacks. I'm currently slowly moving to a more secure dev flow, but it adds overhead. Especially if your dev system is also your laptop. First step is to run any kind of dev tool (especially builds) in a container. Through this often also means running e.g. a language server in the container while running your IDE out of it and making sure nothing will trigger your IDE to do thinks outside of the container...