@kirschwipfel @glyph @AndresFreundTec > If the packager chooses to use the official tarball as "the source", validating the checksum would not have helped. :-(

Unfortunately, yeah.

> Also whether it's always possible to run running autoreconf depends on the content of the tarball.

Of course if it isn't a C project then it probably isn't. If it is such a project, then one should have such tooling installed.

> Which brings me to the (preliminary) conclusion that we'd better use repos as source of trust

That is more sensible generally, as the history of an object and its belonging to a project is a reified (and verifiable) relationship under code versioning sytems, unlike arbitrary buckets of files.