This is a great article, that touches on issues like reproducible builds and software supply chain security. It also highlights the problem that some software

This is a great article, that touches on issues like reproducible builds and software supply chain security. It also highlights the problem that some software can lack what we might call "reproducible source": > In their ESEC/FSE 2021 paper on LastPyMile, Duc-Ly Vu et al. empirically show that “the last mile from source to package” on PyPI is indeed the weakest link in the software supply chain, and that actual differences between packaged source code and upstream source code are observed in the wild. There was a clever attempt to solve this problem in the JavaScript/npm ecosystem a few years ago, but sadly it never became officially supported: https://hackernoon.com/what-if-we-could-verify-npm-packages-c2a319cff758 https://hackernoon.com/what-if-we-could-verify-npm-packages-...