Also, there are numerous discussions about how to ensure a build/binary is what it purports to be. I'm trying to find those…

EDIT:

https://news.ycombinator.com/item?id=8023035