Reproducible builds, combined with digital signatures and an append-only cryptographic ledger, solve a lot of these trust issues.

https://paragonie.com/blog/2016/10/guide-automatic-security-...