I don't think it's as much a technical problem as it is a social, or process, problem. Math and distribution won't solve those. If the introduction of an exploi

I don't think it's as much a technical problem as it is a social, or process, problem. Math and distribution won't solve those. If the introduction of an exploit is done well (e.g. the XZ exploit), the provenance of the malicious code will pass muster. It'll just be doing bad things, at least from the OSS consumer's perspective.