[kelnos]

I'm not sure that really gives you the guarantees you think it does, though.

For example, I could push some malicious code, tag it, wait for Packagist to finish pulling it to publish a package, and then amend history to remove the malicious code, rewrite the git-tag, and force-push both to the git server.

This scheme makes it hard/impossible to push mismatching code by accident, but doesn't do much to stop a malicious actor.

[estebank]

This kind of thing is one of the reasons crates.io distributes source only, and that published crate dependencies can't depend on other repositories (that might allow for that attack).