“I publish releases as tar files on the official web site and only there.”
The official repository exists to say there is no official repository. Every other copy on GitHub is someone else’s code with his name on it. Supply chain security, jwz style.