Comment by zwass

contents:read to contents:write is a big deal! Just to pick out a random widely used project, nodejs [1] has a number of unsigned commits to the main branch. Their commits could have been tampered with during this timeframe.

What about release artifacts?

[1]: https://github.com/nodejs/node/commits/main