Absolutely yes. As a rule of thumb, for sure. However, in reality the problem isn’t binary per se, but anything that’s too obfuscated or boilerplatey to audit m

Absolutely yes. As a rule of thumb, for sure. However, in reality the problem isn’t binary per se, but anything that’s too obfuscated or boilerplatey to audit manually. It could be magical strange strings or more commonly massive generated code (autoconf?). Those things should ideally not be checked in, imo, but at the very least, there needs to be an idempotent script that reproduces those same files and checks that they are derived correctly from other parts of the code. Ideally also in a separate dir that can be deleted cheaply and regenerated. For instance, in Go it’s quite common to generate files and check them in, for eg ORMs. If I run `rm -r ./gen` and then `go generate`, git will report a clean working dir if all is dandy. It’s trivial to add a CI hook for this to detect tampering. Similarly, you could check in the code that generates garbage with a seed, and thus have it be reproducible. You still need to audit the generators, but that’s acceptable.