Hacker News Reader

Having a reproducible build does not prove that the tarball contains the same source as git.

SLSA aims to achieve this, though, right? Specifically going from level 2 to level 3.