> would prove nothing It could surely prove something: those are reproducible builds. That means you can prove after some breach is detected that it originates

> would prove nothing It could surely prove something: those are reproducible builds. That means you can prove after some breach is detected that it originates from the given sources, if it is so. That in turn means that if something happens it won’t be Huawei employees who would investigate these sources. I’m sure that once a company offers the sources like this the company itself won’t plan to mess with the sources. Because then the unwanten intervention can be proved.