The backdoor a second build can see
The backdoor sat in the release tarball and not in the git tree. Closing that gap is what reproducibility is for, and it's the highest-value control to come out of the whole incident.
The backdoor sat in the release tarball and not in the git tree. Closing that gap is what reproducibility is for, and it's the highest-value control to come out of the whole incident.
