There are a lot of options and even more opinions on what is "best". You might have more success looking into nix for this purpose since it solves a lot of security questions with reproducible builds.