Yep. Or it could be official Debian + some specific packages, a bit like Mobian.
There's a group as ISCAS who are rebuilding everything in Fedora for unclear reasons (Fedora has a perfectly good effort to build RISC-V packages at http://fedora.riscv.rocks). Not sure if they're also rebuilding Debian too.
The thing to be checked are the installed GPG keys that are trusted for package signing.