Who would have thought that package repo concepts with automatic fetch during build could be a security risk?

Static linking makes this worse.

Granted, static linking for web apps is great and far better then the alternatives.

But now we deliver static linked desktop and system packages. The security nightmares just began (looking at you canonical)