> My one question is how security is upheld in what seems like a project maintained by a small number of people. This is a really good question, and one that n

> My one question is how security is upheld in what seems like a project maintained by a small number of people. This is a really good question, and one that needs to be asked more. When it comes to distributions, small ones seem to either tend to blindly track their upstream (say Debian or Ubuntu), and add a few custom packages over the top, or go it alone completely, and have to manage all their own distribution and building. The latter really needs a lot of time spent dealing with CVEs. When a backport of a patch is needed (for a non rolling release distribution), that's effort that smaller distributions can struggle with. I can't find it just now, but I've seen a table comparing different Linux distributions, and their time in days to ship to users a patch for given vulnerabilities. Some of the bigger distributions were certainly not the best. In terms of security around software supply chains, reproducible builds are one possible way to do that. Nothing (or almost nothing) is going to stop a rogue developer in the team from adding a malicious patch though.