Any word on trying to tackle package build verification/reproductibility so users can be guaranteed that the package was built from the source code? The proble

Any word on trying to tackle package build verification/reproductibility so users can be guaranteed that the package was built from the source code? The problems like with rubygems from yesterday and npm a few weeks back would be gone with something like that.