I've never seen anyone evaluating code in the environments I've been in. In many ways, I run into the reverse, where it's a given that these build processes are

I've never seen anyone evaluating code in the environments I've been in. In many ways, I run into the reverse, where it's a given that these build processes are obtuse, and so they're simply untrusted as opposed to pulling them apart. Administrators either rely on paid products, or long, manual processes. I've unfortunately had more than one mind numbing conversation where another administrator will tell me that it's a "script" and therefor, I don't know what it does, and that there "may be" some hidden black magic that will instantly pwn all of our systems. Attempting to explain that I verified the functionality line-by-line brings blank stares, as if it's utterly impossible for someone to derive the dark magics that are code. Thankfully, I haven't run into many instances where software is blindly installed as the author relates, but his point in that "no one knows how it works" combined with the lack of attribution creates an environment of mistrust which greatly limits our ability to take advantage of open source software.