I was just thinking about this topic this morning, so quite timely post! I received a PR with binary test data files that were copied from an upstream ecosyste

I was just thinking about this topic this morning, so quite timely post! I received a PR with binary test data files that were copied from an upstream ecosystem. Similarly, I had copied files from that repo, but who should trust me? Submodules seemed too heavyweight, so I was contemplating a CI script that compared selected checksums with a clone. This seems like a great general solution so will take a look at dropping it in!