But if you went through all those steps to check the binary, you have built it yourself. So why not build it from source in the first place?

I think what he's trying to say is that a random user can compile the program and say "Hey, i added X feature to bitcoin, try it!".

While in fact it had code that copies wallet.dat and send it to a remote server for someone else's use or directly sending the coins to a 'new' address.

You're right, that makes sense.

But speaking from experience, it will be very difficult though to exactly reproduce a compilation environment. Getting the same targets is incredibly hard. A small unrelated difference in a .h file in some vague dependency can have impact on the optimisation process resulting in slightly different executable.

For some compilers, even the time and date (of the source files) and who knows, phase of the moon could matter

You could package the build environment as a VMWare/Virtualbox image and distribute that. But that'd only be legal for Linux. Also, how can you be sure that hasn't been tampered with. Hmm...

Edit: another solution would be to completely implement the bitcoin client in a readable language such as Python, that doesn't need a compile chain. Verifying is then a piece of cake. But where do you get the Python interpreter from...

Short story: just compile it yourself with your own trusted tools, ignore the posted binaries

Cool!

Does that also work for the Windows version? (whose users are the biggest consumers of binaries, probably)

Good hearing that, BlueMatt.