Committing built artifacts presents similar problems: how do you know that the committed artifacts are in fact derived from their sources? Or from non-backdoored versions of build tools for that matter? Hello Ken Thompson attacks.
I don't believe there's a nice easy answer to these questions.
What we do in jq is rely on GitHub Actions to run the build and `make dist`. In fact, we could now stop committing the bison/flex outputs, too, since we can make sure that the tarball includes them.
We do also publish the git repo snapshots that GitHub auto-generates for releases, though we do that because GitHub doesn't give one a choice.
