Surely you aren&#x27;t suggesting that a reasonable answer is to <i>read the code yourself</i> and compare it to a known version?<p>Obviously, the mainstream way is a hash-based file verification.<p>Which again, <i>everybody</i> needn&#x27;t do - only a small number - in order to catch a bad actor in the act.<p>But I presume you are trying to make some bigger point.  What is that?