Hacker News Reader

What's next, checking that Releases match the code on Github?

With what, a reproducible build? Madness! Madness I say!

Having a reproducible build does not prove that the tarball contains the same source as git.

SLSA aims to achieve this, though, right? Specifically going from level 2 to level 3.