I&#x27;d start with the requirements for secure SCM&#x27;s in general. Wheeler has those:<p><a href="http:&#x2F;&#x2F;www.dwheeler.com&#x2F;essays&#x2F;scm-security.html" rel="nofollow">http:&#x2F;&#x2F;www.dwheeler.com&#x2F;essays&#x2F;scm-security.html</a><p>Then add endpoint security. Then add certified compilation to know compiler passes don&#x27;t add vulnerabilities. Then add reproducible builds, cryptographic signing, and so on. Now one sees the scope of the problem. At this point, most people will just ignore most of the problem in favor of implementing a subset and saying they &quot;secured the build and deployment process.&quot; ;)