Guix has tooling to verify binaries: https://guix.gnu.org/en/manual/en/html_node/Invoking-guix-challenge.html https://guix.gnu.org/en/manual/en/html_node/Invok

Guix has tooling to verify binaries: https://guix.gnu.org/en/manual/en/html_node/Invoking-guix-challenge.html https://guix.gnu.org/en/manual/en/html_node/Invoking-guix-ch... "guix build --no-grafts --no-substitutes --check foo" will force a local rebuild of package foo and fail if the result is not bit-identical. "guix challenge" will compare your local binaries against multiple cache servers. I build everything locally and compare my results with the official substitute servers from time to time.