This is important work, and I thank you for it. These public transparency logs are important for keeping honest people honest, but also for keeping dishonest people out - If someone does manage to backdoor Google's build process, this is how they'll know.
It’s great that these reproducible builds are possible and this is an incredibly thorough and careful validation. Thanks!
Repo of sourcespotter: https://github.com/SSLMate/sourcespotter
This is important work, and I thank you for it. These public transparency logs are important for keeping honest people honest, but also for keeping dishonest people out - If someone does manage to backdoor Google's build process, this is how they'll know.