Download a signed repository, verify it (including some code check) and build yourself. It's fewer steps than trusting also some package maintainer or build bo

Download a signed repository, verify it (including some code check) and build yourself. It's fewer steps than trusting also some package maintainer or build bot to not be compromised.