Trusting trust only applies if we're taking about something that's a dependency of the compiler (or rather of the toolchain). Otherwise this is just the tedious problem of whether the build process is deterministic (e.g. does it include current time somewhere in the output?).