We’ve regressed from the previous norm of open source projects providing stable source tarballs with fixed checksums, sometimes even with cryptographic signatures.
It's the downstream tooling ( i.e. all the builds and package managers ) that need to clean their act up.