> Supply-chain attacks are about to destroy our current model of trust in FOSS If you are referring to the various NPM style issues that cropped up in the past

> Supply-chain attacks are about to destroy our current model of trust in FOSS If you are referring to the various NPM style issues that cropped up in the past couple of years, I would say that non-curated public repositories are definitely _NOT_ "the current model of trust in FOSS". The current model of trust is a curated restricted store where trusted people publish signed versions of the software, namely the individual distributions' repositories. The public versions of these, something like the AUR and PPAs, always come with caveats and trust disclaimers. The fact that there are programming languages communities that want to circumvent this model does not mean that they represent the status quo.