Something like an Ethereum contract could be used for this. And the smart contract could also allow for deprecating/flagging bad releases as long as the transac

Something like an Ethereum contract could be used for this. And the smart contract could also allow for deprecating/flagging bad releases as long as the transaction comes from the original author.