Hacker News new | ask | show | jobs
by someguydave 1754 days ago
presumably upstream signed commits and/or releases would prevent most nefarious stuff