My team and I built stagex as the first software build toolchain that internally mandates 100% determinism and full source bootstrapping. It is explicitly designed for supply chain security to trust no single human or computer.

Also container native and soon to be LLVM native.

It is our best answer so far to the ROTT paper.

https://codeberg.org/stagex/stagex

See also the Bootstrappable Builds website/community.

https://bootstrappable.org/