Reproducible builds could help here, perhaps. If GitHub's CI runners and GitLab's CI runners (for example) are producing the same tarballs, that's probably a g

Reproducible builds could help here, perhaps. If GitHub's CI runners and GitLab's CI runners (for example) are producing the same tarballs, that's probably a good sign.