You don't need to trust the code on the server -- that's the point.
You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.
You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.
is there a trusted compilation service that uses a distributed agreement mechanism, à la blockchain or DHT for validating some git/svn hash against a binary.
every downloadable source publishes its own binary hashes but the whole practice is somewhat moot in the event of server compromise, not to mention build reproducability.
Of course, you have to trust your compiler and OS, but with a service you would have to trust their compiler and OS.
Was never an issue till now though.