Post #1434851

@dirkriehle Except nope, most packagers are not different but also the packagers are not the ones targeted by the Supply Chain people these days. The packager is not the one that has to sign their commits as an example or make sure the library can be built reproducibly.