(CVS) Detect when files associated with tag/label have changed

How can I detect when a developer updates files associated with a tag/label in CVS, then changes the tag to point to the new versions? The use case is developers surreptitiously making changes after the checked-in and tagged files have been peer-reviewed and approved, but before they have been built & deployed. I would like to avoid getting & diffing all the files at two distinct points in time. Is it possible to get a checksum of all files associated with a tag?

Yes, I k开发者_如何学Gonow there are "challenges" with the process.

You could use a CVS taginfo hook to either log or email whenever a developer tags anything. There is example usage in this question. This would give you some visibility on who is retagging things and when.

CVS does not provide checksumming of files but you could certainly add in a checksumming taginfo hook and the output could be appended to your log/email. The only thing to be wary of here is CVS keyword substitution. If you make use of that at all then any simple checksumming will be pointless.

Setting aside the technicalities, this may just be a policy issue. If you don't want your developers retagging things (except under exceptional circumstances) then make that the policy and make them aware of it. Make sure there is a known process for dealing with code changes that need to be made after the review stage.