In Stagex we already produce a deterministic, full-source-bootstrapped, and oci-native builds of curl. release: https://hub.docker.com/layers/stagex/curl/lates

In Stagex we already produce a deterministic, full-source-bootstrapped, and oci-native builds of curl. release: https://hub.docker.com/layers/stagex/curl/latest/images/sha256-dcb686988d8fc52abe879e4a6fb292b2f96103a2f9eedfb83509e3f965a85498?context=explore https://hub.docker.com/layers/stagex/curl/latest/images/sha2... source: https://codeberg.org/stagex/stagex/src/branch/main/packages/curl/Containerfile https://codeberg.org/stagex/stagex/src/branch/main/packages/... signatures: https://codeberg.org/stagex/stagex/src/branch/main/signatures/stagex/curl@sha256=dcb686988d8fc52abe879e4a6fb292b2f96103a2f9eedfb83509e3f965a85498 https://codeberg.org/stagex/stagex/src/branch/main/signature... Every package is bootstrapped all the way up from a heavily reproduced 256 byte assembly seed (Stage0/live-bootstrap) and built by two or more maintainers with confirmed matching hashes, and with signatures from well known keys. 100% of commits in our repos are also signed, and every PR merge also comes with a signed merge commit by the reviewer. Information on how to verify our keys is found in the maintainers file: https://codeberg.org/stagex/stagex/src/branch/main/MAINTAINERS https://codeberg.org/stagex/stagex/src/branch/main/MAINTAINE... If the curl team wants a similar level of supply chain security for their own official binaries or Dockerfile we would suggest cloning our Containerfile and hash-locking all dependencies to the latest stagex release (please by all means reproduce, verify, and sign that too!). This should be easy for curl maintainers to build and get identical hashes for their own release binaries to the ones we build and sign. Stagex could also be used to produce source tarballs with generated files from similarly deterministic/multi-signed versions of autotools etc. I am not convinced there is a good case for having any auto-generated files in the source archives though. Force distros to bring their own autotools, etc., imo.