Comment by grahar64

Deterministic compilation is the best way to let people validate what they are downloading from repositories is what is in the codebases.