If you shift the trust just one allegorical bit you don’t necessarily have to read all the code; just compare the sha256 hash with a known git commit and scan t

If you shift the trust just one allegorical bit you don’t necessarily have to read all the code; just compare the sha256 hash with a known git commit and scan through the recent changes in the repo. Compiling from scratch isn’t necessarily such a big deal these days (guix/NixOS/gentoo for base system, locally built containers for orchestrated services). Personally I’m fine with putting some level of trust in the maintainers of Debian apt repos but everything else I definitely do take a look at where it’s coming from and what’s going on. There’s a middle ground between fine-combing the source tree and blindly accepting whatever comes from arbitrary upstreams.