This is important work, and I thank you for it. These public transparency logs are important for keeping honest people honest, but also for keeping dishonest people out - If someone does manage to backdoor Google's build process, this is how they'll know.

Repo of sourcespotter: https://github.com/SSLMate/sourcespotter

It’s great that these reproducible builds are possible and this is an incredibly thorough and careful validation. Thanks!