[tom1337]

but how can you verify that the prebuilt binaries aren’t compromised?

[voidUpdate]

Out of interest, do you verify that every single binary file on your machine isn't compromised? All the packages coming from your package manager?

[tom1337]

I absolutely don't. I even sometimes use "curl | bash" to install new things on my machine because most of the time it's easy and I tend to trust the authors.

My point was just that I don't think moving to pre-built binaries solves this issue.

[jcupitt]

sharp downloads over https and checks the sha256 (I think?) of the archive.