Complying with the guidelines for source urls
    
    https://fedoraproject.org/wiki/Packaging:SourceURL#Github describes in
    perfect detail what to do about source urls. Also this other bit:
    
    > If the upstream does create tarballs you should use them as tarballs
    > provide an easier trail for people auditing the packages.
    
    In this case unbit *does* provide tarballs outside the git repo