@dalias @leftpaddotpy @alanc @raito But something would still have to fetch those versions or re-run them, or someone malicious, along the lines of "Hans Jansen"/"Jia Tan", could commit a malicious script decorated with plausible lies about how it was produced. Perhaps easiest to just have the build hosts run autotools themselves, and ignore any purported build artifacts that happen to be present.