Software projects will outlive git. Mine has gone CVS -> Monotone -> Mercurial -> Git over 20 years, it'll probably move again. But you can still download the t

Software projects will outlive git. Mine has gone CVS -> Monotone -> Mercurial -> Git over 20 years, it'll probably move again. But you can still download the tarballs from any of the releases made with those various systems, and they still have the same sha1sum (or now sha256sum). Making reproducible tarballs from VCS isn't hard - with the advice from https://reproducible-builds.org/docs/archives/ https://reproducible-builds.org/docs/archives/ (and requiring gnu tar) it's possible to get byte exact output from both Mercurial or git mirrors, on both Linux and MacOS. Put that in the github CI and it's reasonably difficult to subvert (compare against a local build too at release time). It would be nice if "git archive" had guarantees about archive format, and if the github "download a tar.gz" matched that, but it doesn't seem to be the case at present.