I was idly wondering about this the other day (maybe php prompted it). Making release tarballs should become a reproducible process too [1]. That avoids the "ha

I was idly wondering about this the other day (maybe php prompted it). Making release tarballs should become a reproducible process too [1]. That avoids the "hack the releaser's dev machine" attack if you verify elsewhere, or avoids the "hack the CI pipeline" if you verify on your dev machine. My personal approach is to read the line by line diff against the last (gpg signed) release, useful too just to be reminded of everything that has changed. Not perfect, but will catch some things. [1] https://reproducible-builds.org/docs/archives/ https://reproducible-builds.org/docs/archives/