Trustix and CAN are -fantastic- for the problems they are intended to solve, but they only cover the consumption side of the supply chain. You can use these to

Trustix and CAN are -fantastic- for the problems they are intended to solve, but they only cover the consumption side of the supply chain. You can use these to ensure the binaries are built from the published code, or that you are using the right published code. You have no idea if the published git commits were not made by a sim swap compromised github account... because maintainers are not required to do the bare minimum such as signing commits. Compare to arch, fedora, debian, and basically every other linux distro that has existed more than a decade. Every maintainer signs their own contributions with well known keys so they cannot be impersonated and so later stages of the supply chain cannot tamper with them. Newer distros like Nix and Alpine decided do get rid of all that security overhead in order to attract a huge pile of randos as maintainers. I mean, it worked, but at a very high price.