[ngalstyan4]

The more general problem with trusting software supply chains is well described in Ken Thompson's Turing award lecture on "Trusting Trust"[1]

[1]: http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...