> the release tarball being different than the source is > the maintainer provided tarball was honestly generated from the original source code. How, then? Wh

> the release tarball being different than the source is > the maintainer provided tarball was honestly generated from the original source code. How, then? What about differing versions, etc. or has it been mentioned and I just missed it? Just make sure the generated tarball can be generated from the source code itself, do not exclude anything, git add & commit everything. Can't we do that? We would still have to look at commit history in this case, I believe, and again, he said it himself, it was harmless to the naked eye, so even then, how could we verify? Maybe I don't understand what he meant by verification, but if maintained tarballs are generated from the owner's source code and is not on GitHub (or anywhere else, just a git repo), that is a problem in itself. Of course there was more to it than just pushing poisoned test files, but still. I do not see how Nix would have prevented it, if the git repo has those test files and with seemingly harmless code (and is reproducible). Perhaps what we can do is: if an (in)famous project has changed its main lead, then pay closer attention to the commits and check who it is? I don't know, TBH. Did I misunderstand the article, or am I missing something?