It doesn't break supply chain security for anybody with power to change the situation.
It is an easy to overlook this, but even for someone in position of power to change, creating different code with the same hash is borderline impossible.
alt Hacker News
It is an easy to overlook this, but even for someone in position of power to change, creating different code with the same hash is borderline impossible.