>>87Tuning in again, because a colleague linked me here.
Please do not misunderstand the term "audit" in this context.
It's not easily chosen, as we have security audits in relevant
places, but the raw term "audit" is equivalent to a "revision",
and that's exactly what I did in the code.
Over the years, we've improved our coding style and how to write good code, so the audits made sure these good styles were applied consistently across the base.
In no way does this claim the software is bug-free after an audit, only in a coding-state which we consider consistent.
It's easy to write bug-free software when it's trivial (e.g. echo, true, false, ...), but the more complex it gets, you can always hit new traps.
Don't shit your pants when we fix a bug in tar(1), the recent changes were fixes for edge-cases (limited user-namespace) and are an actual convenience to support tars with vendor-extensions.
We find bugs here and there, but overall, we have a stable product and for instance pass the busybox-tests without problems (modulo XSI-extensions).