Maybe something like SLSA could solve your issue https://slsa.dev/ https://slsa.dev/ the idea is to create a metadata standard so that packages can provide buil

Maybe something like SLSA could solve your issue https://slsa.dev/ https://slsa.dev/ the idea is to create a metadata standard so that packages can provide build providence information. So public build systems like github actions can sign a manifest explaining what build actions were executed and what the input and output of those actions are. That way you could verify a package was built from a specific set of sources with a specific set of build actions without requiring reproducibility. This assumes you trust the public build system not to lie though.