> I don't really have a solid solution to this My solution to this when designing Homebrew’s binary packages was to store the checksums for the binaries in Git

> I don't really have a solid solution to this My solution to this when designing Homebrew’s binary packages was to store the checksums for the binaries in Git but the binaries themselves elsewhere (inspired by Homebrew already storing source checksums in Git). On Homebrew, therefore, you’d have to compromise both the binaries and the Git repository. These are both nowadays on GitHub but the binaries in GitHub Packages are addressed by their checksum and the Git repository has a good audit log.