“Installing most open source software today is equivalent to picking up a random thumb-drive off the sidewalk and plugging it into your machine.”

https://security.googleblog.com/2021/03/introducing-sigstore-easy-code-signing.html

😬 It’s painful but it’s kind of true.