Tim Landscheidt writes:
A major factor seems to have been the discrepancy between
"the source code" at GitHub & Co. that was probably
scrutinized by many eyes and the shipped, but different
artifact. So one step (as a inter-distribution effort)
could be to continuously automatically compare shipped
artifacts with their "make dist" equivalents and publishing
the results.
There are several versions of autoconf, automake, and libtool in wide use.
There are also many libraries that ship autotools macros for inclusion in
code that builds against those libraries. Those macros don't change very
often, but they do change.
You will need to match the version for everything in the build environment
in order to meaningfully compare autotools-generated shellcode.