How can you verify that your extension actually runs the code that's in the open source repository? Extensions' integrity can be signed and verified against something that was also authored by the creator, but what verifies that the code in the linked repository is the same one, not a different one?

Checksums are super useful, too - if you build the project yourself, you can get the checksum, and if it's different than the one in the store, you can ask questions.

A web of trust style checksum confirmation network would be invaluable for browser extensions. Building that into a browser's security model would be great - an extension has to be validated with a minimum score or it's disabled unless manually activated.

I think you can build it yourself and install that?

Browser extension stores should be more transparent about open source and licensing.

And probably they should collaborate with CI providers - eg. make contract with GitHub to sign artifacts with "these files were built using following pipeline from commit XYZ in repository JohnSmith/UserBase".

And rightfully so