> This diagram demonstrates how to get a trusted binary without reproducible builds. Ages ago our device firmware release processes caught the early stage of a

> This diagram demonstrates how to get a trusted binary without reproducible builds. Ages ago our device firmware release processes caught the early stage of a malware infection because the hash of one of our intermediate code generators (win32 exe) changed between two adjacent releases without any commits that should've impacted that tool. Turns out they had hooked something into windows to monitor for exe accesses and were accidentally patching out codegen. Eventually you just top trusting anything and live in the woods I guess.