You don't need to trust the code on the server -- that's the point.

You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.

ah yes, sorry.

is there a trusted compilation service that uses a distributed agreement mechanism, à la blockchain or DHT for validating some git/svn hash against a binary.

every downloadable source publishes its own binary hashes but the whole practice is somewhat moot in the event of server compromise, not to mention build reproducability.

You can compile the code yourself, then you would know the binary matches the source.

Of course, you have to trust your compiler and OS, but with a service you would have to trust their compiler and OS.

True, although if someone was going to put a backdoor into a compiler, they'd have to be idiots to attack tarsnap; much better to have it trojan an OS kernel or something else which is trusted and far more widely used.

Do you trust your compiler?

Hey you guys provide binaries now? News to me!

Was never an issue till now though.

We're shipping binaries for Debian and derived platforms. Other platforms will follow.

If you build it yourself with the same compiler and options, and get the same bit-exact binary, then it's safe to assume the binary was built from those sources, since infiltrating the compiler team is not an easy job.