If you want to have guaranteed runtime linkage built from trusted source, you might want to give BOSH (http://bosh.io http://bosh.io) a look for config/release

If you want to have guaranteed runtime linkage built from trusted source, you might want to give BOSH (http://bosh.io http://bosh.io) a look for config/release management - it insists/prefers on compiling all dependencies from source, from trusted links, with signature checks. For example with Hadoop, here is the build script: https://github.com/cf-platform-eng/hadoop-boshrelease/tree/master/packages/hadoop https://github.com/cf-platform-eng/hadoop-boshrelease/tree/m... Learning curve is a bit steep but it's another approach to this immutable infrastructure trend that's built for large production, enables rolling canary upgrades, etc.