Re: Good.
Buildroot and similar build systems have integrity checks that require the downloaded package to match the expected hash.
So if someone did change it by any means, the download would fail and the new build machine would need to get its copy by another path.
I had presumed everybody did that.
Aside from that, it is almost impossible to create a new git commit with the same hash as an existing commit.
What kind of idiot uses the tip, or a named label without checking it is the same commit?
Biting the hand that feeds IT
