We ship a tool that modifies kernel attack surface. The entire supply chain from compiler to installer is a potential vector. OpenClaw packages are signed, but that's just the final artifact.

Current practice I see:
* People verify the project's PGP signature on the tarball
* Maybe check the pinned SHA256 in the install script
* Almost nobody audits the SBOM or the dependencies that get pulled at build time

Example: our `nano_claw` module. The makefile pulls three external libraries. The builder's CI could be compromised, injecting code into one of those libs. The final signature would still be valid.

What I do:
* Generate SBOM for every release candidate
* Diff it against previous version
* Manually review the source of every new or updated dependency, even transitive ones
* This includes toolchains and builder images

This is unsustainable at scale. Are others doing this? What's the automated check you trust?

Tooling gaps I've found:
* Most SBOM generators don't trace into build dependencies
* No standard way to sign and verify an SBOM across the pipeline
* Dependency pinning works until you need to update for a CVE, then you're back to manual review