[jka]

Ok: you've provided two requirements that I agree with:

- It should be possible to compare between two releases (I'd personally like to see a code diff, ideally with a complete path of the commits involved)

- Providing a reputation visibility mechanism (for publishers? author(s)?) across a series of releases is important

Those don't require user accounts necessarily, though. And responding to the end of your message: identity assurances, yep, those seem necessary; access management, I'm not so sure.

[ecnahc515]

Access management is required to have identity assurances. If there's no way to ensure someone's identity is secure, how do we know it's them in the first place?