Aren't reproducible builds pretty well established as being important for security? How do you know that the developers are providing you with the binaries that

Aren't reproducible builds pretty well established as being important for security? How do you know that the developers are providing you with the binaries that they claim? Most people do not compile their own software, they used signed binary distributions being given to them. If you have reproducible builds, third parties can more easily verify independently that the code being distributed is the same as the code published in the open source repositories. This doesn't just keep dev teams honest, it also provides defenses against situations like those where a hacker gains control of the website being used for distribution. I believe reproducible builds have helped to catch this real life issue at least once in the cryptocurrency community (with Monero). To me, that's enough to justify their existence.