A backdoor in xz

> When people stop using curated tarballs, developers will just add generated files into the SCM.

There is a solution to that these days.
A Github Actions can take the tagged source code commit, generate artifacts and sign them so you do have the provenance that the artifact (tarball) was created from the given source code with the given github action.