This is why I love the approach taken by Debian (and most other distros).
Although they provide binary packages, they insist on building everything from source, independently from the upstream projects such as Bitcoin. Moreover, the build process itself must be able to run entirely with Free Software. And the same must hold for all dependencies. Otherwise a package can't make into their "main" distribution (just into "contrib" or "non-free", but users of these parts are warned).
That way, an attacker can't simply tamper with binaries. They have to distribute the manipulates sources instead. Although that kind of attack may still be feasible, it requires a lot more openness from the attacker than just changing sources privately and distributing merely faulty binaries.
This will be futher hardened by Debian's initiative to provide reproducible builds, so that if one of their many build servers is compromised, this can be detected by simply comparing hashes of the resulting binary packages produced by other build servers and/or local build of the maintainers or any curious user:
https://wiki.debian.org/ReproducibleBuilds
Speaking of Debian, unfortunately Bitcoin never made it beyond Debian/Unstable (Sid), because the Bitcoin release process appears to be incompatible with the Debian release process, especially regarding backporting security fixes, so the Debian people decided to be better safe than sorry:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718272
Although they provide binary packages, they insist on building everything from source, independently from the upstream projects such as Bitcoin. Moreover, the build process itself must be able to run entirely with Free Software. And the same must hold for all dependencies. Otherwise a package can't make into their "main" distribution (just into "contrib" or "non-free", but users of these parts are warned).
That way, an attacker can't simply tamper with binaries. They have to distribute the manipulates sources instead. Although that kind of attack may still be feasible, it requires a lot more openness from the attacker than just changing sources privately and distributing merely faulty binaries.
This will be futher hardened by Debian's initiative to provide reproducible builds, so that if one of their many build servers is compromised, this can be detected by simply comparing hashes of the resulting binary packages produced by other build servers and/or local build of the maintainers or any curious user:
https://wiki.debian.org/ReproducibleBuilds
Speaking of Debian, unfortunately Bitcoin never made it beyond Debian/Unstable (Sid), because the Bitcoin release process appears to be incompatible with the Debian release process, especially regarding backporting security fixes, so the Debian people decided to be better safe than sorry:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718272