Reproducible builds are the way. But source available is better for people who are worried about malware
How do you reproduce a build without source?
Meticulously with Ghidra I suppose. This trend of saying it’s to protect us is getting old. The only way to prevent malware is by making the source available for us to see for ourselves.
Yeah, reproducible builds are meaningless for users without a reference to reproduce.