Gmail is kind of tricky, I am not sure if you are talking about the web interface or something else. The web interface is a slightly more complex case, as you'd

Gmail is kind of tricky, I am not sure if you are talking about the web interface or something else. The web interface is a slightly more complex case, as you'd have to patch the browser, and check every piece of javascript. You cannot check the server part yourself, of course. But you wouldn't use SAAS if you were interested in security in the first place, unless you trust Google's servers, in which case HTTPS+HSTS (+cert pinning?) should be enough. Otherwise (android app? Browser js/html/css?) you separately compile gmail. Assuming the build is reproductible, you can check that its hash corresponds to what was sent to you.