While this question could be posed in a vendor agnostic fashion - I'll gear it around Github and Azure to give it some context.
I am planning an open-source project, in a sensitive business domain (banking). As such, I feel it would be important for users who download and install it to be able to verify the provenance of the binary - through some kind of independently tracked "chain of custody" - tracing it back to the actual source code label that the CI process consumed.
How is this currently achieved? If at all? Are there any known mechanisms/practices for this?
What I imagine, is a publicly visible landing page in Azure DevOps, hosted by Microsoft (unable to tampered by anyone, not even the project owner) - which maps the installation binary hash to the source control label thumbprint. This would allow the user to trust that the binary in their possession is guaranteed to be the product of the code they are auditing.