Comment by amelius

Let's not kid ourselves. A state level actor who is playing the long game can compromise any distro, package, etc. without us knowing about it.