
Checksums Don't Prove Who Built It
For a long time, my definition of a successful software release was pretty simple: the tests passed, the binaries built, and the checksums matched. Ship it! That still sounds reasonable, but there is a gap hiding between we built some bytes and users downloaded the bytes we intended to publish.