A distro uses a consistent toolchain, but doesn't write most of the code. The projects writing the vast bulk of the code, like linux, git, firefox, gtk, qt, ope

A distro uses a consistent toolchain, but doesn't write most of the code. The projects writing the vast bulk of the code, like linux, git, firefox, gtk, qt, openssl, curl, etc, don't strictly control the toolchain, and it does vary between distros and distro releases. Distros like Arch and Alpine keep the patching to a minimum, most packages need no patches. RedHat/Fedora and Ubuntu do patch significantly more. Debian is in the middle ... there was an infamous incident where they patched openssl to fix an uninitialized-memory warning, and caused a huge security issue for many people: https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... (yes, openssl sucks, but still.) So this is why distros take their cleanup patches upstream. Distro patches are for real observed bugs that aren't fixed in an upstream release (or not in the desired major release branch), or to just disable -Werror in projects that don't know better.