This is an old problem solved dozens of ways that mainstream just refuses to deal with. The requirement is even standard for proprietary products going for DO-178B certification. I believe they do quite manual confirmation but automated exists. The solution is called certified compilation: the verifiable transformation of source into binaries. You break the process into a series of steps which each can be verified with the CST&#x27;s&#x2F;AST&#x27;s handed from one to the next. You can implement the steps yourself or validate someone else&#x27;s, even easier if it&#x27;s a safe[r] language. Examples each using different methods are VLISP [1], FLINT [2], and CompCert C [3].<p>Running Debian through CompCert while putting more work into CompCert for portability and optimization is the easiest solution with long-term benefits. Performance will go up steadily. Bug count will go down steadily because that&#x27;s what SML&#x2F;Ocaml does. Code will be more readable. Repeat for most trusted tools to drive assurance up across the board.<p>If they don&#x27;t want to do that, then the result will be something along lines of just having a bunch of people compile and sign the distro publishing signatures, etc. You will trust that they trusted whatever they all looked at. And anyone whose studied GCC&#x27;s source, etc will know that basically means they all saw the same code. They&#x27;d have to understand it all to have known if there was a weakness introduced. They won&#x27;t, use of C&#x2F;C++ makes that harder, plenty of rope to hang one&#x27;s self in any common action, and it&#x27;s why those of us doing subversion-resistant development use languages like ML&#x27;s or Oberon. FOSS needs to similarly transition toward safe, comprehensible tools that aren&#x27;t backdoor generators just by architecture &amp; language used.<p>Otherwise, all this talk of preventing subversion is just talk: they&#x27;re going to get in. And if not subversion, the endless stream of 0-day&#x27;s from the language and architectural choices will continue to do the job. A re-implementation of the TCB&#x27;s of our systems is long overdue.<p>[1] <a href="http:&#x2F;&#x2F;citeseerx.ist.psu.edu&#x2F;viewdoc&#x2F;download?doi=10.1.1.51.2824&amp;rep=rep1&amp;type=pdf" rel="nofollow">http:&#x2F;&#x2F;citeseerx.ist.psu.edu&#x2F;viewdoc&#x2F;download?doi=10.1.1.51....</a><p>[2] <a href="http:&#x2F;&#x2F;flint.cs.yale.edu&#x2F;flint&#x2F;software.html" rel="nofollow">http:&#x2F;&#x2F;flint.cs.yale.edu&#x2F;flint&#x2F;software.html</a><p>[3] <a href="http:&#x2F;&#x2F;compcert.inria.fr&#x2F;" rel="nofollow">http:&#x2F;&#x2F;compcert.inria.fr&#x2F;</a>