JC all points well made regarding the importance of knowing the...

JC all points well made regarding the importance of knowing the provenance of compiled software.

I've made (the unpopular) point before that other organisations, often in heavily regulated industries like Gaming and Financial Services that are consuming 3rd party software have solved this problem in often quite simple ways like holding source code in escrow which they regularly audit through trusted 3rd parties and... critically, they build themselves.

When NET began its programme of regional IoT hubs I thought that was going to be their strategy. Branch the OG Chinese source and host it independently "in country", invite audit and allow it to evolve independently in full view of its local customers.