You can't really tell for sure. The resulting binaries will depend heavily on deterministic factors such as the exact versions of build tools and build OS used,

You can't really tell for sure. The resulting binaries will depend heavily on deterministic factors such as the exact versions of build tools and build OS used, and may also depend on non-deterministic factors such as the order of execution of different threads in the build process affecting orderings in the resulting binaries. With packages, the easiest way to eliminate doubt is to build the binary packages from the source packages yourself. This is relatively straightforward as source packages contain all the information needed (options etc) to make the build automation work. You should also read Ken Thompson's "Reflections on Trusting Trust" (http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html), which shows that even if the binaries were built from the exact source they claim, you still can't trust them unless you can also trust the toolchain and its entire ancestry.