also ideally you'd want it to have a reproducible build process, so you can verify that what's in the source is what you get