Let's say you have an app that prides itself on open source technologies and the full codebase of your app being open source is what attracts users.
How can you guarantee your users that your open sourced code is what's actually being used in production?
For security sensitive open-source projects, it is desirable to provide reproducible builds. Given the same source code, a reproducible build will always create bit-identical output. That way users can take your source code and check whether the binaries you provided were tampered with, e.g. used a patched source code.
If your software is not executed by users but e.g. on your server as a SaaS offering, no good trust mechanism is possible. One way to handle this is to implement client-side/end-to-end encryption. That way, it is less important whether the server contains a backdoor since the server never sees plaintext data. However, this is not feasible for most applications.
