When you read words like: "Nobody seems to know how to..", you should mentally translate this to "_I_ don't know how to ... and I am unwilling to learn"
At my job, I've spent a lot of time making the existing software reproducible. It's tedious and time-consuming, but also pretty straightforward. Take that "sudo curl" script, read every line, tear it apart, and make nice, installable .deb. Write a makefile which downloads requirements from servers _you_ trust and runs the builder tool, possibly with local proxy set to "discourage" it from hitting open internet. Set up local docker registry, inspect the images that go in it.
At my job, I've spent a lot of time making the existing software reproducible. It's tedious and time-consuming, but also pretty straightforward. Take that "sudo curl" script, read every line, tear it apart, and make nice, installable .deb. Write a makefile which downloads requirements from servers _you_ trust and runs the builder tool, possibly with local proxy set to "discourage" it from hitting open internet. Set up local docker registry, inspect the images that go in it.