Unless you are building from source yourself that means exactly and precisely zip.
Did you also build the compiler?
https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
> Perhaps it's more important to trust the people who wrote the code
Yeah... about that.
I'm using the codex package from the official Arch Linux repositories.
https://gitlab.archlinux.org/archlinux/packaging/packages/op...
It is sourced from the GitHub repository.