Various large organizations rebuild Debian to detect unexpected changes both as part of https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/Repro

Various large organizations rebuild Debian to detect unexpected changes both as part of https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds and independently. > I don't think it adds much to security unless they also read all the code Some distros ensure that hundreds of thousands of users deploy and use the same packages consistently before making a distro release. This creates plenty of accountability, making it very difficult for a supply chain attack to go undetected. > A fraction and based on my old Ruby gems memories, fairly out of date. Just like buying a car, you have a tradeoff between well-known and little-known, well tested or bleeding edge. What's safer for production use?