Embed Notice

@kirschwipfel @lispi314 @AndresFreundTec @glyph
Sounds good. But some projects have a build stage which generates lots of things. Packagers for distributions need to set up the needed environment and perform these steps. It seems much easier to use a provided artifact in these cases.

I think this attack is hard to defend against: An evil insider in the project with control over the code and artifacts. One could also hide malicious stuff in the code itself directly, in plain sight.