Git Hash Chain Malleability

This whitepaper demonstrates that signed Git commits are not uniquely bound to their commit hashes, even when they display a valid "Verified" badge on GitHub. The authors show that attackers can transform the signature encoding of an existing signed commit—without possessing the private signing...