Hacker News Reader

Doesn't this mean that malicious inputs can deliberately cause super tiny or super huge chunks?

Bazel caches tend to have a size limit.

You need to trust your build execution machine anyway. They have your source code and you will be executing the artifacts that they produce!

The same is true without CDC, and you can configure a maximum size.