...
You wrote that you had been pushing for source release "for the version of Atlantis which has been out for ~1 month", and I responded by saying it would be a problem if the commit history going back to the last public derosuite commit were not included, and that even if it was, it would still be problematic, given that git is not immutable.
...
Okay, there was a slight misunderstanding, but not a major one. After all, you once again said that even if you had the commit history going back to the last public release of DeroSuite that you still couldn't be sure that the history hadn't been "revised," let's say, because git itself is not immutable.
That really seems like you are saying you won't trust any code release, even if it includes all the commit history, version control, etc.
That is accurate, and is an unfortunate consequence of dero having taken the code closed-source, which was just shortsighted and unnecessary. That action irrevocably shifted things from a "trust in the code" situation to a "trust in the team" one. Which itself is fine, so long as a person has a clear understanding that this is what they are doing.