I appreciate all that, but at least with the example of SQLLite, that's a decision by the developers, not because of an external influence (presumably). My issu

I appreciate all that, but at least with the example of SQLLite, that's a decision by the developers, not because of an external influence (presumably). My issue here is that a government has decided that a specific country is not allowed to participate in open source; yes, Redhat implemented it, but they did so out of fear of retribution from the US government and because their understanding is that the US government required it. Maintainers controlling what gets into the project is not the same as a foreign entity not at all contributing/participating in a project declaring who can and cannot participate. >It really is. The Linux kernel has itself thwarted what appeared to be an attempt by U.S. intelligence services to inject vulnerabilities into the kernel source code. Now the fact that the U.S. government was itself the threat may make worries about Iran doing the same seem rather silly, but in this case I think the fact that Fedora source code is used by the DoD makes sense. I think this is tangential though to what I'm saying. It's not about whether or not attacks like this __are possible__, it's that there's absolutely no reason that a contributor from a specific region is any more of a threat than any other. Nothing stops Iran or any other sanctioned country from getting US based VMs + crypto and slipping/sneaking in some code. It's not about if a specific country makes a backdoor, it's "is there a backdoor at all?" Any secret backdoor snuck in for sale by an interested party is just as usable by a given government as one made by Iran. For me, it just falls flat as a real security analysis; heck, I imagine a sick irony where a US created back-door inserted by one agency ends up being used to leak data from another agency. A backdoor is a backdoor.