From what I’ve read, thus-far, prohibiting autotools would be a good 1st-step.
Then auditing all the damn ocean-of-vulnerability-in-a-single-crufty-swamp dependencies, & getting committed about clarity & accountability in packages, would probably be required.
I read an article, a couple years ago, about web-frameworks…
The guy doing the writing said he found they were often malware, or corrupt, or trojans, or utter-bullshit…
Haskell’s got a kind of mantram: don’t bring in a whole framework, just compose what you need, yourself, together.
Its a granularity-difference.
Requiring a framework, which itself requires other frameworks, as that guy was pointing-out ( he wasn’t interested in Haskell ), is a liability nightmare.
But the culture of just having an infinite bring-in of frameworks & libraries, so one can write a little, easy code, is a culture that is biting the world’s security in the ass.
It cannot be, that people just include everything from everywhere, & somehow have secure/trustworthy systems.
To have a secure, trustworthy system, one needs to know that one has disincluded corruption/malicious-code.
That requires limiting what’s included, that includes auditing, that includes accountability, that includes having understandable, sufficiently-clear stuff that one is including.
Consistently, at all levels, relentlessly.
It’s a chain: you cannot have a weak-link without compromising the whole chain.
You cannot compromise ANY subsystem in a distro, & have a trustworthy distro.
There are 2 contradictory paradigms: the “magic bullet paradigm”, which doesn’t care how much rot, compromise, anything, so long as they include the “magic bullet” which takes-out the competitor…
… vs the “no weak-points, whatsoever, paradigm”, which doesn’t rely on magic, it relies on defense-in-depth, and carefulness, and everybody working coherently, etc, in order to disallow corruption/malicious-actors any leverage/grasp on us.
They are cultures, not just ideas.
Some people cannot tolerate a “no weak-points” culture, they “NEED” to compromise things ( I don’t care about the bugs, get more features in!!" ), and they must be put out into the other organizations/operations, because they CANNOT tolerate careful-paradigm.
It truly is a culture, or “religion”, and there’s no faking it.
Look to OpenBSD, & see what it takes to be like them…
Back in the last century, iirc, or the very early 2000’s, I logged-out of my desktop ( linux ) one time & discovered there was a new user on my machine…
the new username was “you are dead”.
1st time I knew I’d been cracked.
Not a nice feeling.
Educational, however, & motivating…
did me good.
I’m glad the person was more interested in communicating my trusting foolishness to me, than in doing real harm…
_ /\ _