Deps authoritative sources

Where are the authoritative sources for all the binaries in deps? Clearly the VC binaries can be obtained directly from Microsoft. I’d like to build urbackup without relying on the urbackup’s git hosted copies of binaries at all. Frankly, I don’t trust that they haven’t been altered in some way that leaks privacy.