Authenticate a tarball through a signed tag in a git repository (with reproducible builds) - View it on GitHub