@clacke @smxi I don't think what you describe here is correct. I think what you describe here is true for their publicly available repositories. As a customer you have the right to ask for the exact source code that your binary packages were compiled from, and I am not aware of any instance of them not honoring them.