> At least in a typical linux distro the binary is built by the distributing org, with some review of where the source comes from. This "feature" falls apart f

> At least in a typical linux distro the binary is built by the distributing org, with some review of where the source comes from. This "feature" falls apart for nonfree software, which most commercial apps are. You can use Spotify and Steam's PPA but will similarly have no idea what source was included in them.