By definition, for open-source software, you can compile it yourself. But most users of most distros don't do that, instead they use pre-built binary packages.

By definition, for open-source software, you can compile it yourself. But most users of most distros don't do that, instead they use pre-built binary packages. Which means someone has to build and upload those binary packages. How can you tell that the person who built or hosts the binary packages didn't change the source code (for example, putting in backdoors or other malware)? It helps with this problem if anyone else can build the same source code, and get a byte-for-byte identical copy of the binary package. This sounds trivial, but it actually requires some dedicated support from build tools and build scripts. (You have to have the exact same version of the compiler and everything else, the compiler wants to automatically put the build timestamp in the executable, the order the OS lists files in a directory can sometimes change, the timestamps in files contained in tar/zip archives can't be set to the current time, etc.) Some people in the Debian community have been making an effort to update all of Debian's packages to be byte-for-byte reproducible.