@jimgar then the question is "do you trust the binary app or will you vendor a known-good version of the source and built it yourself?". b/c this seems like a great target for adversary mischief — and it has 4K+ ⭐️, so attackers know it's popular.