Yeah I noticed that too. Sorry but no way I'm installing this given that.

Looks like the company running this is simply located in a co-working space in China. Didn't know that just living in China made you a possible PRC asset.

"living in China made you a possible PRC asset"

Unfortunately, really anything coming out of China might be a PRC asset. We just wouldn't know unless it was too late.

All Chinese companies are possible PRC assets:

https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-da...

Note - I'm not commenting about whether these guys are PRC assets or not. Or whether there is anything nefarious going on at all. I'm just pointing out that they could be compelled to become assets, even if that's against their wishes.

I mean, and all US companies are possible NSA/CIA assets. Which is kinda worse because it was already proven more than once. Snowden and PRISM, anyone?

Kinda worse? That's highly debatable. It's just a different risk profile. I personally don't expect the US government to take an interest in my activities, but I'm not as convinced about the Chinese for various reasons.

More to your point, as far as I'm aware, individuals can't be forced under law to cooperate with US intelligence. In China, individuals have to cooperate - by law - and the penalties for non-compliance are harsh.

In the case of an open source project maintained by individuals, that's an important consideration.

I mean gitea is too, as long as its fully open source its OK for me personally.

How do you know the packaged binaries were built from the published source?

You don't. If you are paranoid you can just build it yourself!

How do you know your compiler was built from its published sources? :)

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...