New comment by Chocimier on void-packages repository

https://github.com/void-linux/void-packages/pull/23472#issuecomment-657117544

Comment:
Ok, verifying checksum of file from gh against checksum of file from gh is a weak link. Do it need rebuild with upstream signed sources?