> No-one dares to commit spyware to GitHub.

I see where you are coming from, but this is simply not true. You can argue nobody concerned with his own reputation commits spyware to a public repo, but malicious actors are usually not concerned with that or try to stay anonymous in the first place.

Here is a recent example of malicious commits to a github repo: https://news.ycombinator.com/item?id=17458329

> You can argue nobody concerned with his own reputation commits spyware to a public repo, but malicious actors are usually not concerned with that or try to stay anonymous in the first place.

It's not so black-and-white though, hence "keeps the honest guys honest". Are Microsoft and Google 'malicious actors'? They're hungry for our data, but they often only do it when they don't think we'll be able to find out what they're doing. https://news.ycombinator.com/item?id=17749330

The fact that the source code is available does not guarantee that the blob is the product of that source.

This is why there is the "Reproducible Builds"[0] initiative from Debian folks.

[0] https://reproducible-builds.org/

That's true and, to me, has been brought on the spotlight from Microsoft practices around VSCode. On the other hand, for an OSS project, building the binary is not that hard.