{"id":"https://openalex.org/W7166832032","doi":"https://doi.org/10.48550/arxiv.2606.31354","title":"Mutating the \"Immutable\": A Large-Scale Study of Git Tag Alterations","display_name":"Mutating the \"Immutable\": A Large-Scale Study of Git Tag Alterations","publication_year":2026,"publication_date":"2026-06-30","ids":{"openalex":"https://openalex.org/W7166832032","doi":"https://doi.org/10.48550/arxiv.2606.31354"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.31354","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.31354","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.31354","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139801486","display_name":"Solal Rapaport","orcid":null},"institutions":[{"id":"https://openalex.org/I4210165912","display_name":"Laboratoire Traitement et Communication de l\u2019Information","ror":"https://ror.org/057er4c39","country_code":"FR","type":"facility","lineage":["https://openalex.org/I12356871","https://openalex.org/I205703379","https://openalex.org/I4210145102","https://openalex.org/I4210165912"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Rapaport, Solal","raw_affiliation_strings":["IP Paris, LTCI, ACES, INFRES"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IP Paris, LTCI, ACES, INFRES","institution_ids":["https://openalex.org/I4210165912"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087170492","display_name":"Laurent Pautet","orcid":"https://orcid.org/0000-0003-0888-187X"},"institutions":[{"id":"https://openalex.org/I4210165912","display_name":"Laboratoire Traitement et Communication de l\u2019Information","ror":"https://ror.org/057er4c39","country_code":"FR","type":"facility","lineage":["https://openalex.org/I12356871","https://openalex.org/I205703379","https://openalex.org/I4210145102","https://openalex.org/I4210165912"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Pautet, Laurent","raw_affiliation_strings":["IP Paris, LTCI, ACES, INFRES"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IP Paris, LTCI, ACES, INFRES","institution_ids":["https://openalex.org/I4210165912"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050403544","display_name":"Samuel Tardieu","orcid":"https://orcid.org/0000-0002-6885-1480"},"institutions":[{"id":"https://openalex.org/I4210165912","display_name":"Laboratoire Traitement et Communication de l\u2019Information","ror":"https://ror.org/057er4c39","country_code":"FR","type":"facility","lineage":["https://openalex.org/I12356871","https://openalex.org/I205703379","https://openalex.org/I4210145102","https://openalex.org/I4210165912"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Tardieu, Samuel","raw_affiliation_strings":["IP Paris, LTCI, ACES, INFRES"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IP Paris, LTCI, ACES, INFRES","institution_ids":["https://openalex.org/I4210165912"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139830485","display_name":"Stefano Zacchiroli","orcid":null},"institutions":[{"id":"https://openalex.org/I4210165912","display_name":"Laboratoire Traitement et Communication de l\u2019Information","ror":"https://ror.org/057er4c39","country_code":"FR","type":"facility","lineage":["https://openalex.org/I12356871","https://openalex.org/I205703379","https://openalex.org/I4210145102","https://openalex.org/I4210165912"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Zacchiroli, Stefano","raw_affiliation_strings":["IP Paris, LTCI, ACES, INFRES"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IP Paris, LTCI, ACES, INFRES","institution_ids":["https://openalex.org/I4210165912"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5000357741","display_name":"Th\u00e9o Zimmermann","orcid":"https://orcid.org/0000-0002-3580-8806"},"institutions":[{"id":"https://openalex.org/I4210165912","display_name":"Laboratoire Traitement et Communication de l\u2019Information","ror":"https://ror.org/057er4c39","country_code":"FR","type":"facility","lineage":["https://openalex.org/I12356871","https://openalex.org/I205703379","https://openalex.org/I4210145102","https://openalex.org/I4210165912"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Zimmermann, Th\u00e9o","raw_affiliation_strings":["IP Paris, LTCI, ACES, INFRES"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IP Paris, LTCI, ACES, INFRES","institution_ids":["https://openalex.org/I4210165912"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210165912"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.3903999924659729,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.3903999924659729,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.21709999442100525,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.08020000159740448,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/commit","display_name":"Commit","score":0.7135000228881836},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5770999789237976},{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.5663999915122986},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.3898000121116638},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.38089999556541443},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.3804999887943268},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.3127000033855438}],"concepts":[{"id":"https://openalex.org/C153180980","wikidata":"https://www.wikidata.org/wiki/Q19776675","display_name":"Commit","level":2,"score":0.7135000228881836},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5770999789237976},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.5663999915122986},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.542900025844574},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.3898000121116638},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.38089999556541443},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3804999887943268},{"id":"https://openalex.org/C70721500","wikidata":"https://www.wikidata.org/wiki/Q177005","display_name":"Computational biology","level":1,"score":0.3504999876022339},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.34689998626708984},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.3375000059604645},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.3127000033855438},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.30250000953674316},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.29760000109672546},{"id":"https://openalex.org/C10272871","wikidata":"https://www.wikidata.org/wiki/Q929972","display_name":"Software inspection","level":5,"score":0.27730000019073486},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2721000015735626},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.26669999957084656},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.2662000060081482},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.2655999958515167},{"id":"https://openalex.org/C21491501","wikidata":"https://www.wikidata.org/wiki/Q430253","display_name":"Backporting","level":5,"score":0.2639000117778778},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.25380000472068787}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.31354","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.31354","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.31354","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.31354","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.5578200221061707,"id":"https://metadata.un.org/sdg/11","display_name":"Sustainable cities and communities"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Git":[0,29],"tags":[1,31,95,123],"are":[2,124],"commonly":[3],"viewed":[4],"as":[5,162],"immutable":[6,125],"references":[7],"in":[8,63,97],"software":[9,22,70],"development,":[10],"marking":[11],"releases":[12],"and":[13,21,50,75,136,152],"specific":[14],"repository":[15],"states":[16],"that":[17,91,109,122,133,145,153],"underpin":[18],"build":[19,104,134],"reproducibility":[20],"supply-chain":[23,165],"integrity.":[24,52],"Despite":[25],"their":[26],"intended":[27],"immutability,":[28],"allows":[30],"to":[32,141],"be":[33],"altered":[34,96],"through":[35],"deletion":[36],"or":[37],"modification":[38],"via":[39],"force-pushed":[40],"updates.":[41],"The":[42],"prevalence":[43],"of":[44,60,159],"such":[45],"alterations":[46,62,80,111,161],"threatens":[47],"reproducible":[48,113],"builds":[49],"dependency":[51],"We":[53,130],"conduct":[54],"the":[55,119,154],"first":[56],"large-scale":[57],"empirical":[58],"study":[59],"tag":[61,79,110,160],"public":[64],"code":[65],"repositories,":[66],"analyzing":[67],"328.4":[68],"M":[69,78],"repositories":[71],"from":[72],"Software":[73],"Heritage":[74],"identifying":[76],"10.2":[77],"affecting":[81],"189":[82],"k":[83],"unique":[84],"repositories.":[85],"A":[86],"cross-analysis":[87],"with":[88,100],"Nixpkgs":[89],"reveals":[90],"32":[92],"packages":[93],"reference":[94],"our":[98],"dataset,":[99],"7":[101],"exhibiting":[102],"confirmed":[103],"errors,":[105],"providing":[106],"concrete":[107],"evidence":[108],"break":[112],"package":[114,137],"builds.":[115],"Our":[116],"findings":[117],"challenge":[118],"widespread":[120],"assumption":[121],"anchors":[126],"for":[127],"released":[128],"software.":[129],"therefore":[131],"recommend":[132],"systems":[135],"managers":[138],"pin":[139],"dependencies":[140],"cryptographic":[142],"commit":[143],"hashes,":[144],"development":[146],"forges":[147],"expose":[148],"tagmutation":[149],"audit":[150],"logs,":[151],"community":[155],"adopt":[156],"systematic":[157],"monitoring":[158],"a":[163],"standard":[164],"security":[166],"practice.":[167]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-02T00:00:00"}