I'd love a specific counter-example. I've never in my life encountered a sysadmin who read all or even part of the source code of any major package before deplo

I'd love a specific counter-example. I've never in my life encountered a sysadmin who read all or even part of the source code of any major package before deploying it. I mean, do you read the source code of the Linux kernel, PostgreSQL, nginx, OpenSSL, ... before installing it? If Basel requires that level of auditing, I'd love to see a cite. There are some pretty heavy-handed regulations out there, but this would be clearly unworkable.