i am looking to extend our self-bootstrapping system so every binary we depend on is from a known source and happened upon this. spack, another project i'm now working on, has much less well thought-out self-bootstrapping capabilities, but is also used on supercomputers which have very different versions of gcc on them