[jsty]

Whilst it would be nice if everyone had the time and resources to code review and build their entire source dependency tree, is this ever going to be a reality for the long tail of enterprises who struggle with even resourcing / recruiting for their current workload? I think the vast majority are going to continue outsourcing this responsibility onto enterprise distros / vendors for a long time to come.

[brown9-2]

I think things would be easier for the long tail with more investment from all in the tools space - better support for monolithic repos, unified CI/CD systems, etc.