Solal Rapaport | arXiv Science

arXiv2026

Mutating the "Immutable": A Large-Scale Study of Git Tag Alterations

Git tags are commonly viewed as immutable references in software development, marking releases and specific repository states that underpin build reproducibility and software supply-chain integrity. Despite their intended immutability, Git allows tags to be altered through deletion or modification via force-pushed updates. The prevalence of such alterations threatens reproducible builds and dependency integrity. We conduct the first large-scale empirical study of tag alterations in public code repositories, analyzing 328.4 M software repositories from Software Heritage and identifying 10.2 M tag alterations affecting 189 k unique repositories. A cross-analysis with Nixpkgs reveals that 32 packages reference tags altered in our dataset, with 7 exhibiting confirmed build errors, providing concrete evidence that tag alterations break reproducible package builds. Our findings challenge the widespread assumption that tags are immutable anchors for released software. We therefore recommend that build systems and package managers pin dependencies to cryptographic commit hashes, that development forges expose tagmutation audit logs, and that the community adopt systematic monitoring of tag alterations as a standard supply-chain security practice.

cs.SE↗

arXiv2025

Altered Histories in Version Control System Repositories: Evidence from the Trenches

Version Control Systems (VCS) like Git allow developers to locally rewrite recorded history, e.g., to reorder and suppress commits or specific data in them. These alterations have legitimate use cases, but become problematic when performed on public branches that have downstream users: they break push/pull workflows, challenge the integrity and reproducibility of repositories, and create opportunities for supply chain attackers to sneak into them nefarious changes. We conduct the first large-scale investigation of Git history alterations in public code repositories. We analyze 111 M (millions) repositories archived by Software Heritage, which preserves VCS histories even across alterations. We find history alterations in 1.22 M repositories, for a total of 8.7 M rewritten histories. We categorize changes by where they happen (which repositories, which branches) and what is changed in them (files or commit metadata). Conducting two targeted case studies we show that altered histories recurrently change licenses retroactively, or are used to remove ''secrets'' (e.g., private keys) committed by mistake. As these behaviors correspond to bad practices-in terms of project governance or security management, respectively-that software recipients might want to avoid, we introduce GitHistorian, an automated tool, that developers can use to spot and describe history alterations in public Git repositories.

cs.SE↗