In the past ^[1] numerous ^[2] file ^[3] distribution ^[4] servers ^[5] were ^[6] attacked ^[7] and the attacker replaced a release tarball/zip with a modificated version including a backdoor. Usually the distributions use some kind of signatures to avoid such an attack against their own infrastructure but this doesn't include the initial retrieval of the source code from upstream (usually done through the tarballs).