Since writing the post you link, I finally threw my hands up and made a new distro with some security engineer peers that prioritizes supply chain security and

Since writing the post you link, I finally threw my hands up and made a new distro with some security engineer peers that prioritizes supply chain security and mandates 100% full source bootstrapping and determinism: https://stagex.tools https://stagex.tools It does not even try to be a workstation distro so we can get away with a small number of packages, focusing on building software with high accountability. Thankfully OCI build tooling is mature enough now that we can build using standards and do not need a custom build framework and custom languages like nix/guix does anymore.