I'll go even further and bring up Trusting Trust - whole chain needs to be open source and verifiable.

and you need to be able to compile each and every part of it.