<p​lowsof:matrix.org> in dockefile . linux we download the release tarballs for boost, expat, openssl, unbound.. i found http file mirrors for them specifically but now i see that we can just git clone / checkout commit and build them like everything else

<t​obtoht:monero.social> plowsof: yes, prefer building directly from source

<t​obtoht:monero.social> I meant to say prefer git over tarballs. Tarballs may include files that are not present in the git repository which presents a supply chain attack vector and is just another thing to verify.