Shameless plug for https://snapdir.org which focuses on this particular use case using regular git and auditable plain text manifests