The linker is in a better position to inject malicious code into your system than xz/liblzma if compromised because it can do whatever it wants with the programs being linked. For example, replacing a specific function during linking openssh would be a pretty easy hack. Therefore, it is important to use a trustworthy linker binary to build your program. But how do you build a trustworthy linker? If you use a malicious linker to link another linker, it can inject code into the new linker which in turn could do something malicious to other programs. This is the well-known chain of trust problem. This is a real issue for us because we distribute mold binary packages on our GitHub release pages. Fortunately, we recently implemented a change in the script to create the binary packages so that the script is reproducible -- meaning that regardless of the environment it's run in, the script always creates bit-for-bit identical output for the same git commit. With the reproducible build, you can independently verify that our binary distributions are actually built from the corresponding release of source files. You can also ensure that no third-party binaries are involved during the build. Thanks to Docker and QEMU, it is pretty easy to write a reproducible build script these days. I'd strongly recommend doing the same if you are distributing binary tarballs. The script for the mold linker is available here: github.com/rui314/mold/blob/…