Mutating the "Immutable": A Large-Scale Study of Git Tag Alterations
For software supply-chain security and build reproducibility, this work provides concrete evidence that the assumed immutability of Git tags is violated at scale, undermining dependency integrity.
This study is the first large-scale empirical analysis of Git tag alterations, examining 328.4 million repositories and finding 10.2 million tag alterations across 189,000 unique repositories. Cross-analysis with Nixpkgs shows that 32 packages reference altered tags, with 7 causing confirmed build errors, demonstrating that tag alterations break reproducible builds.
Git tags are commonly viewed as immutable references in software development, marking releases and specific repository states that underpin build reproducibility and software supply-chain integrity. Despite their intended immutability, Git allows tags to be altered through deletion or modification via force-pushed updates. The prevalence of such alterations threatens reproducible builds and dependency integrity. We conduct the first large-scale empirical study of tag alterations in public code repositories, analyzing 328.4 M software repositories from Software Heritage and identifying 10.2 M tag alterations affecting 189 k unique repositories. A cross-analysis with Nixpkgs reveals that 32 packages reference tags altered in our dataset, with 7 exhibiting confirmed build errors, providing concrete evidence that tag alterations break reproducible package builds. Our findings challenge the widespread assumption that tags are immutable anchors for released software. We therefore recommend that build systems and package managers pin dependencies to cryptographic commit hashes, that development forges expose tagmutation audit logs, and that the community adopt systematic monitoring of tag alterations as a standard supply-chain security practice.