"The main threat model that reproducible builds are meant to guard against is simple: an attacker, who has write access to a binary distribution of some piece o

"The main threat model that reproducible builds are meant to guard against is simple: an attacker, who has write access to a binary distribution of some piece of software, uploads a malicious binary rather than the true output of compiling the corresponding source." This isn't the only attack reproducible builds are about. They started as part of Wheeler's Countering Trusting Trust paper on how to beat the Karger attack of modifying compilers to backdoor themselves. So, there's a MITM problem and compiler subversion problem they're about in most places doing them. Most of the threads on the topic (including this one) also have people brining up stuff in Thompson paper or Wheeler's technique. That threat model requires more security, esp against compiler vulnerabilities or malicious source. My other argument was that users are trusting an image of their OS from a repo that comes in binary. If they trust that, then why not trust the binary of the compiler or other apps in that repo? If they don't trust the repo, they shouldn't be downloading privileged software from it that runs in kernel mode. Bit of a contradiction. One counter is that it might be compromised later on. Well, do they not do software updates either then? Benefits of reproducible binaries over source-based distribution and updates from secure repo are slim to none outside saving compilation time.