Please see : https://research.swtch.com/vgo-repro - reproducible, verifiable builds. The same thing is possible in vgo, with planned support for hashes.