Immutable releases are now generally available on GitHub • Hacker News Board

Re: Immutable releases are now generally available on GitHub

#61

Post by matt_kantor » Fri, Oct 31, 2025, 10:41 PM UTC

weinzierl wrote: post #48

dare944 wrote: post #46

> When you enable immutable releases, the following protections are enforced: • Git tags cannot be moved or deleted; • Release assets cannot be modified or deleted On the face of it, this seems like a non-starter. If a particular immutable release represents a danger to the consumer (extreme example: the software contains a bug that could result in physical injury) one must have the ability to retract that release so…

I think there are compelling reasons to support: 1. Unremovable 2. Uninstallable while keeping the data available 3. Removing the release completely (while keeping an audit log that this happened) 1 is for use-cases where availability trumps security. I'd argue this should never be the case but at the same time it is how our world ticks by and large. Hard to take this away from people. 2 is for security, forensics an…

Your note on 3 brings up a good point: I'm sure that if there's a DMCA takedown notice or somesuch that GitHub will in fact delete your "immutable" release which "can't be deleted".

Re: Immutable releases are now generally available on GitHub

#62

Post by bluGill » Fri, Oct 31, 2025, 10:55 PM UTC

cortesoft wrote: post #50

danudey wrote: post #35

Earlier quoted context omitted.

Depending on the project, doing a re-release with an appended or updated version number might be a huge hassle. For a small, single-binary program run by an agile team it's pretty trivial to recall a release and publish a replacement, but for larger open-source projects with long, complex, release processes, paying customers, external docs, etc., spending an entire new day doing an entire new release to fix one typo…

In that case, it seems like immutable releases aren't what that project wants. You don't HAVE to enable immutable releases. The ability to change a release is fundamentally incompatible with immutable releases, by definition. You can have one or the other, not both.

immutable releases are not what anyone wants. A few bad actors forced them on us.

Re: Immutable releases are now generally available on GitHub

#63

Post by duskdozer » Sat, Nov 01, 2025, 9:21 AM UTC

bluGill wrote: post #62

cortesoft wrote: post #50

Earlier quoted context omitted.

In that case, it seems like immutable releases aren't what that project wants. You don't HAVE to enable immutable releases. The ability to change a release is fundamentally incompatible with immutable releases, by definition. You can have one or the other, not both.

immutable releases are not what anyone wants. A few bad actors forced them on us.

idk, i've come across people who are really adamant about the idea of immutability for its own sake, even as far as never amending or rebasing

Re: Immutable releases are now generally available on GitHub

#64

Post by bluGill » Sat, Nov 01, 2025, 1:29 PM UTC

duskdozer wrote: post #63

bluGill wrote: post #62

Earlier quoted context omitted.

immutable releases are not what anyone wants. A few bad actors forced them on us.

idk, i've come across people who are really adamant about the idea of immutability for its own sake, even as far as never amending or rebasing

i was likely too strong in saying nobody. Though they want immutabilty for theoretical purity reasons not for security which I'm sure is why github is doing this. Still it isn't bad toacknowledge them even if most don't care about their conterns.