似乎我对 reproducible 的理解有些出入,不过开源软件的供应链保障确实是只能靠人品…………(目前来讲
https://www.cert.org.cn/publish/main/upload/File/2021%20Risk%20Analysis%20Report%20of%20Open%20Source%20Software%20%20.pdf
https://www.cert.org.cn/publish/main/upload/File/2021%20Risk%20Analysis%20Report%20of%20Open%20Source%20Software%20%20.pdf