https://seclists.org/oss-sec/2019/q4/122 tl;dr there's no clear solution yet, but we should implement one when a satisfactory workaround is identified.