The repo needs to be clean, but pre-built release binaries backdoored. It's classier this way.