Comment by xpe

> Deterministic compilation is the best way to let people validate what they are downloading from repositories is what is in the codebases.

"the best way"? Please make the argument for why. To do it properly, you must steel-man the alternatives (not shoot down straw-men)