5.24.0 seems to have been retagged.

[SMillerDev]

The git manual says re-tagging is "the insane thing" to do so I just wanted to make sure that the re-tag of the 5.24.0 release was intentional or if someone compromised the repo and changed the signing settings.

As found in Homebrew/homebrew-core#289553

[vitorvezani]

Hi @SMillerDev, @stefanb, I'm on the Fairwinds team and the one who pushed both v5.24.0 tags (org member with release access; not a CODEOWNER, so cc'ing @sudermanjr / @transient1 to corroborate).

Confirming the re-tag was intentional, not a compromise. While fixing our release signing I updated the goreleaser config and re-ran the release on the existing v5.24.0 tag instead of cutting a new version. The only delta between the two tagged commits is that config change: c85f54c…dd5ec8c.

Re-tagging was the wrong call, apologies for the churn. If you'd prefer a clean, I can cut a v5.24.1.

[stefanb]

Thanks for the confirmation! 🙌

No need to cut a fresh release just for us, but it is your call if you want to do so for other distribution channels and finally, the users.

You could consider enabling immutable releases on GitHub to prevent temptations for such mishaps in the future. 😅
https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases