Each piece of software in the chain must use TPM-like technologies (yes, even GIMP) to make sure it's running a "legitimate" build of the software, on "legitimate" hardware, and re-sign the file at each step along the way (using keys provisioned during some flavour of remote attestation flow, or using a RA-authenticated remote-signing oracle).

The final file embeds every preceding manifest, so you can "verify" all the way back to the original.

If this all sounds patently unworkable, that's because it is.