[fsflover]

> Of course, it's possible to release good source-code and also introduce malware into the official binaries

Which is solved by reproducible builds.

[MaxBarraclough]

Right, or source-based distribution of packages.