Reproducible builds are possible. Something like 94% of debian now builds reproducibly: https://tests.reproducible-builds.org/debian/stretch/index_s... and there's a post on reproducibility in Arch on the front page right now: https://news.ycombinator.com/item?id=15820356. Signal for Android builds reproducibly, too: https://signal.org/blog/reproducible-android/

Of course that only helps if you trust the toolchain.