Security quotes of the week

I would argue that the first choice is marginally better because it at least checks your connection wasn't man-in-the-middled. The packages are built by trusted buildbots which hopefully deals with buildchain issues.

It doesn't distract from your main point though, that you have to trust the actual developers writing the code to not do stupid things. When downloading source from the internet I try as much as possible to verify md5sums so that it's just the developers I need to trust and not the whole internet.

I do await the day that software is distributed as something like Dockerfiles which build and run stuff in containers so I don't even have to trust them completely.