By 'repo that comes in binary', are you referring to some preexisting trusted system, or the desired OS? If the former, then as I said, it's theoretically poss

By 'repo that comes in binary', are you referring to some preexisting trusted system, or the desired OS? If the former, then as I said, it's theoretically possible to build the entire desired OS from source on the existing system, but that's often not supported by OS build systems, and very uncommon in practice as an installation method. If the latter, with reproducible builds you don't have to trust the repo - even for the initial install. You only have to trust that at least one of the people who signed the packages in the repo, ideally after verifying using entirely separate infrastructure, is honest. There's no single point of failure. Well, you also have to trust that the source isn't backdoored, of course, but that's at least somewhat easier to detect than backdoors in binaries.