I will echo @adw and say our ethos has always been to distrust infrastructure. Validate things for yourself. Make your own reproducible build and validate all the hashes are right. The code is all open and there to be audited by anyone. Thats how you can find out for sure, for yourself, with your own eyes/fingers and skills - that the answer to the subject of this forum post is “no, it is not”