If you are following tech news you probably read that this week Debians efforts in having reproducible builds resulted in making it a policy that packages should be reproducible. In short this means that given the source could anyone should be able to reproduce the resulting packages that are distributed through the Debian repositories.
I think this is very good!
Over at the opsi.org GitHub page you can have a look inside the repositories and you will find all parts that are needed for building. Whenever we release a new version the commit used for that package receives a tag. This is useful not only in pinning down changes between different versions but also if we want to provide patches for specific versions.
Regarding git we still have some repositories left to migrate from Subversion but I am confident to get this tackled until the end of the year. Then everything will be accessible at one location - again.