This is essentially an impossible task.
If you have read Ken Thompson's "Reflections on Trusting Trust", then you already know everything I am about to say. If not, please keep reading:
Imagine I publish an open-source project, that is written in some language, and simply takes input and returns the input unchanged - like a very simple version of
echo. You download my source code, read through it all (it's just a few lines long anyways) and then you compile it. You can be sure that your program does exactly what you think it does, right?
How do you know that your compiler didn't add any extra instructions, such as checking whether or not the input's sha-256 hash is
e257f6eccac764b6cea785a0272e34d3dbc56419eac2ad436b9fb4bddcd10494 and if it is, do something unexpected.
You might say that that is unlikely, but you cannot ever be fully certain of it. But perhaps you want to be fully certain of it, right? After all, you want to cryptographically prove that the software you are running does exactly what the source code says it should do. So you inspect the binary with a reverse-engineering tool, like Ghidra or IDA Pro. But...how can you be sure these tools do what you think they do? Sure, on the surface they might seem as if they show you the binary as it is, but how can you be sure that they don't hide the maliciously inserted code from you?
You could completely forego existing compilers and write your own in bytecode, byte by byte, instruction for instruction, but how would you do that? You need some program that writes those bytes to disk. How do you know that those are not infected and write some extra bytes?
And even if you completely forego programs and just use a magnetized needle and a steady hand, how can you be sure that your CPU actually runs the instructions you want it to run and doesn't run some extra instructions? After all, CPUs run microcode these days, which is difficult to inspect.
... it's extremely hard to prove that a computer does what we think it does. Can you show some hash of some source code or deployment state to show something to your customers? Of course you can. But that really doesn't mean anything.