Post #1251366

To clarify what I mean: the vendor has chosen not to put its software under a copyleft license, which means they have not undertaken a legal obligation to give you source code that matches your binary. They're also not giving you a means to verify the binary that's in that Google Storage bucket, except using a checksum that is *also* in that bucket. So it would seem like you have no way to tell that the software in the binary has anything to do with the code in the repo.