I'm speaking from experience at Google, and honestly our software integrity processes are like nothing I could have imagined coming in. Not everything is perfec

I'm speaking from experience at Google, and honestly our software integrity processes are like nothing I could have imagined coming in. Not everything is perfect and it has clearly evolved over time, but basically for a modern internal Google codebase I don't think I could have much more trust that it is what it claims to be. I don't know if other big tech is quite the same, but from the little I've heard, I suspect that Microsoft, Amazon, Apple, and others in that ilk are similar. I'm very much in the camp of "trust but verify" here. You're right that Solar Winds was an utter disaster. It should never have been able to happen.