Bind delivered binaries to verified build source

internal/delivery/delivery.go

@@ -26,6 +26,7 @@ const (
 type BuildIdentity struct {
 	RepositoryDir   string
 	CandidateCommit string
+	SourceVerified  bool
 	Version         string
 	MainPackage     string
 	BinaryName      string
@@ -139,6 +140,9 @@ func validateBuild(repositoryDir, commit, version string, build *BuildIdentity,
 		}
 		return nil
 	}
+	if !build.SourceVerified {
+		return errors.New("build source was not verified as clean and unchanged during compilation")
+	}
 	buildRepository, err := filepath.Abs(build.RepositoryDir)
 	if err != nil {
 		return fmt.Errorf("resolve build repository: %w", err)