What tooling? Git is just a filesystem with file versions, anything you can check in a tarball can also be checked in Git. The only thing Git adds is a change

What tooling? Git is just a filesystem with file versions, anything you can check in a tarball can also be checked in Git. The only thing Git adds is a change history for the contents in the filesystem (a history that can be forged too - Git even has a bunch of commands for that too). If you cannot trust the authors' tarballs how can you trust their Git repository?