>I expect the code to be exactly what has been reviewed by me under that hash

Sorry, no.

Again, hashes are by definition, insecure. I.e. you don't have a guarantee that the hash references the same commit, just a (very, very strong) probability that it does.

> Everything else would just be a crazy invitation to make supply chain attacks uncircumventable.

What? Uncircumventable? Logically equivalent, I read your statement as "So if all cars are not blue then they must be red"? This does not follow...

I like the last part of the article, which proposes a (very reasonable sounding) extension for people who care (more) about their code-sec. You should be able to swap out your hash algo without having to rebuild your content addressing system.

Separation of Concerns, people...