Unless there are any real consequences from having an OS on your hardware that doesn’t comply, I would just expect most Linux users to grab their install images from mirrors hosted out of state. Even if they amend it to require the mirrors to try and locate visitors to automatically redirect California residents to the tampered images, a VPN would solve that pretty quickly. This just seems like posturing and maybe testing the waters with public reaction, but I’d be more concerned about what the crazier thing is that they’ll ramp up to next if people don’t raise a fuss over this one.