I know some projects do deterministic builds using a pre-made VM. There are Bitcoin bots that periodically build the client and check it against official binaries to detect tampering.