author can't verify , user can't verify that's why we need reproducible builds. if no reproducible builds then, sha256(binary_from_user1) != sha256(binary_from

author can't verify , user can't verify that's why we need reproducible builds. if no reproducible builds then, sha256(binary_from_user1) != sha256(binary_from_user2) For smaller project distributing code source is usually correct choice as auditing src code is better than auditing binaries. But the project like chromium I think reproducible build is essential because you can't force everybody to compile and waste hours right?