just check the submodules, no? reproducible binaries doesn't really matter that much when you are compiling from source (you arn't proving that someone did or

just check the submodules, no? reproducible binaries doesn't really matter that much when you are compiling from source (you arn't proving that someone did or did not tamper with the binary provided, if no one is providing that binary in that situation)