> it sounds like a very unrealistic attack vector. It isn't unrealistic at all. A lot of attack vectors seem unrealistic to the victim until they happen. How

> it sounds like a very unrealistic attack vector. It isn't unrealistic at all. A lot of attack vectors seem unrealistic to the victim until they happen. How realistic is it to think that a hostile actor can inject their code into a build process without touching the disk, then get that corrupted executable signed; then that signed executable is installed by 18000 users with root permission?