> You're relying then on the good/competent intentions of every flawed human with commit rights. The ability to just fix a typo is the inability for anyone to know what code you're actually running. Is that Foo 1.1 with that ostensibly inconsequential fix that broke an edge case, or the other one?

Well, one would only fix an _obvious_ typo that could not possibly
break any edge cases.

But I understand your point -- but then I guess a digital sig really
is the proper solution then, since a "published" attribute could be
easily gotten around (which is why I see it as an artificial barrier).