[growse]

I can't tell if this is sarcasm or not.

Most things we want to do are necessarily complex, so dogmatically adhering to "one simple thing" necessarily drives you towards a towering heap of composed dependencies.

If you want to get rid of the supply chain, you want everything specifically to be non-composable, so that everything has to be reinvented from scratch for that specific solution.

[dmitrygr]

Try that supply chain attack on dropbear running as ssh server on devuan. Simple utility on a simple system made of simple utilities