09:17:51 <m-relay> <p​lowsof:matrix.org> in dockefile . linux we download the release tarballs for  boost, expat, openssl, unbound.. i found http file mirrors for them specifically but now i see that we can just git clone / checkout commit and build them like everything else
14:47:48 <m-relay> <t​obtoht:monero.social> plowsof: yes, prefer building directly from source
14:50:14 <m-relay> <t​obtoht:monero.social> I meant to say prefer git over tarballs. Tarballs may include files that are not present in the git repository which presents a supply chain attack vector and is just another thing to verify.