Gregory's Server
The way this works, is, essentially, quite easy: the whole build process is documented in the same repository, builds are automated via CI/CD and all that is, to reach best support, done in an environment that prevents tampering and (crucially) is *out of your control*.
Then you get #SLSA v3: https://slsa.dev/get-started#slsa-3 (quite easy with GitHub Actions)
Now, you say, you have to trust GitHub? Sure, you do, to achieve this. But threat models: What is more likely compromised: a maintainer/account in your project, or the whole GitHub build infra?
Personally, I was also not quite convinced, given you loose "control" over your build and GitHub could theoretically now inject #malware.
However, as the project itself states, this is not a big deal, if you combine it with the older security feature aka #reproduciblebuilds.
https://slsa.dev/spec/v1.0/faq#q-what-about-reproducible-builds
Now, you say, you have to trust GitHub? Sure, you do, to achieve this. But threat models: What is more likely compromised: a maintainer/account in your project, or the whole GitHub build infra?
Personally, I was also not quite convinced, given you loose "control" over your build and GitHub could theoretically now inject #malware.