Did you read my comment at all before replying? One step is the source, one step implies reproducible build, and alternately specifies a stronger requirememt (source-to-object verification).<p>And no, OSS with reproducible builds is nowhere near enough for software to be trustworthy. It&#x27;s why even Orange Book had more than one sentence in its feature and assurance activities recommendations.<p>Let&#x27;s put it to the test though. If Im right, most the majority of OSS software will be similarly to proprietary full of easily-prevented holes, undocumented&#x2F;barely-clear functionality, and difficulty even building it. Whereas high assurance systems would&#x27;ve had the opposite attributes while faring well during professional pentesting w&#x2F; source.<p>One of us was right for a decade straight. Maybe it&#x27;s because the principles and practices I promoted... work? Evidence in the field is on my side. Neither OSS nor good builds are enough.