Proposal: position-anchored tags to make tag tampering human-visible

[thegravelinspector]

Description

Position-anchored tags: a detection convention

SHA pinning solves the machine problem, but humans can't glance at hex strings. A simple complement: embed the commit position and short hash in the tag name:

v0.18.0-r75-a1b2c3d

The r75 is a slow-moving number anyone familiar with a project will notice if it changes. In this incident, 75 rewritten tags would have shown wildly wrong position numbers — instantly suspicious, no tooling needed.

Full proposal with scripts: https://github.com/thegravelinspector/position-anchored-tags

(Drafted with help from Claude.)

Target

Git Repository

Scanner

Vulnerability