So what’s wrong with just releasing a monolithic static binary for each architecture you want to run it on?

Release engineering works on something that has only recently been codified into a SLSA scale. At the top end is nixos and their very firm validation of code all the way along the supply chain.

At the bottom of the scale, a SLSA score of 0, is “here’s a monolithic binary I found on the website of someone on the interwebs. Even though we don’t know how it was built, nor can we reproduce it or confirm it’s what he built or look at any of the parts to see whether the statically-linked libraries are now at-risk, let’s just run that.”

You … do see how irresponsible that is on every level, right?

Like, 20 years ago I dropped a patch in for Apache, and these days I manage reams of machines using apache, sendmain, winbind, nginx, postfix, etc; to manage those without a proper infrastructure is absolute madness.