Git Commit Hash Malleability: Attackers Can Forge Verified Signatures Without Access to Signing Keys

Git commit signing is widely entrusted to serve as evidence that a commit hash uniquely and immutably identifies a specific piece of signed content. We show this invariant does not hold. Given any signed commit, an attacker without access to the signing k