After reading your comment i wanted to see for myself how its done on Debian or Ubuntu and realized there are no official packages of Webmin for these distros. So my assumption that most people got a package build from the unmodified source might have been wrong as a whole and my comment is indeed misleading on multiple levels. Thanks for clarifying.

I don't get how this could happen. Why would anyone trust their build server to package the release tarball? Were they ever signed and checked by the devs?

The way I understand releases and tarballs, I'd do it like this:

- git on my machine (supposedly safe)

- bundle the source code, sign it however necessary

- upload and publish the tarball + signature & checksums

That way, unless my own machine was compromised, it should be OK.

The typical reason is that one has a build chain which predates docker and those things, where it wasn't guaranteed that doing it on different machines yields the same result, but having a master host gives consistent result, independent from who does it.

In modern times the reason is that the release is produced in a CI pipeline. So once a build is green and matches allmothe rreleas criteria that tested build is released.

In both cases using a git checkout for longer time is not a got idea and builds should be done as exports into clean directories.