To have a verifiable build system and later also a trusted device image, we need to build all binaries from source. To make this easier, I would propose to use Debian/Ubuntu compilers, linkers, programs where possible to offload part of the work to Debian.
Ref: https://github.com/mikeperry-tor/mission-improbable#binary-blobs-that-run-on-the-host-machine
Ref: https://www.reddit.com/r/GrapheneOS/comments/e07t56/building_grapheneos_boot_issues_with_locked/
To have a verifiable build system and later also a trusted device image, we need to build all binaries from source. To make this easier, I would propose to use Debian/Ubuntu compilers, linkers, programs where possible to offload part of the work to Debian.
Ref: https://github.com/mikeperry-tor/mission-improbable#binary-blobs-that-run-on-the-host-machine
Ref: https://www.reddit.com/r/GrapheneOS/comments/e07t56/building_grapheneos_boot_issues_with_locked/