Davor Bonaci <dav...@apache.org> on Monday, January 21, 2019 1:22 PM said:

This is a fair point. In *practice* people depend on those binaries, and it is
practice that matters.

I suggest that, in the longer term, ASF work towards developing *reproducible*
builds and establishing mechanisms to verify the builds of all Apache projects.
It is quite possible to record what tools were used to build something,
reproduce the build in multiple places, and then verify that the different
builds match. Of course, this doesn't eliminate all problems (e.g., by itself
it doesn't counter malicious tools used during a build). However, it counters
many problems (it strongly counters subverted builds, and it even provides a
starting point for countering malicious tools).

Switching to reproducible builds would transform "trusting random people" into
an ASF process that verifies builds. Historically the computing costs would
have been too expensive to do this, but computing is so cheap now that its costs
are not a real barrier.

Technical work is necessary to make this happen, and that obviously takes time &
money, but the most important part is a policy to create & verify reproducible
builds in the first place. Such work has been going on for some time in various
communities; more info is here: https://reproducible-builds.org/

--- David A. Wheeler