Ditto about Debian repos. But as for reading LOC's, comparing the hash won't help if a supply chain attack hit the code before it made it to a commit. I'm not a

Ditto about Debian repos. But as for reading LOC's, comparing the hash won't help if a supply chain attack hit the code before it made it to a commit. I'm not actually advocate reading every LOC. I'm just saying that if you want to use just about anything, some level of trust has to be put in other people & other systems. It should always be a qualified trust though. a trust-but-verify (within reason).