After that I run them in containers, no network access, ro filesystem.
replyAnd then build from source. And make sure it doesn't auto-update so no new malware gets in. This is my idea of a lot of extra work.
replyWhy even ask the question?
replyBuilding from source is nowadays writing one sentence in a chat box. Your idea of extra work is either unbelievably lazy or perhaps outdated by a few years.
replygood luck auditing all transitive dependencies
reply