GitHub Verified Commits Can Be Rewritten Without Breaking Signatures

A recent study published on the Hacker News website demonstrates a critical flaw in how GitHub verifies commit authenticity. While the platform still displays the familiar “Verified” stamp for any signed commit, an attacker who does not possess the signing key can create a second commit containing exactly the same files, author information, and timestamp, yet generate a different hash that still passes signature verification ¹. In other words, the cryptographic guarantee that a commit’s hash uniquely identifies its content no longer holds.

The root of this weakness lies in Git’s reliance on the SHA‑1 hashing algorithm for signatures—a method proven vulnerable to collision attacks as far back as Wang et al.’s demonstration in 2005. Although Git itself has migrated toward more secure algorithms such as BLAKE3 for internal operations and signature verification since around version 2.46 (released late Q1 2027), the signature subsystem had not been updated accordingly when the vulnerability was introduced during Linus Torvalds’ tenure at Linux Kernel development circa early 2009. Consequently, the “verified” label only confirms possession of a valid signing key; it does not enforce immutability of the underlying hash.

Experts note that this issue mirrors problems seen with TLS/SSL certificates, where attackers can craft proxy certificates that maintain valid digital signatures while substituting malicious content. The implications for supply‑chain security are severe: malicious code could be injected into open‑source repositories without invalidating existing verification processes used downstream. A comparable incident occurred in 2018 when rogue npm packages were published under legitimate developer accounts using compromised keys, underscoring how easily trusted distribution channels can be subverted if signature integrity is inadequately enforced ¹.

From an operational standpoint, developers who rely on automated dependency checks and continuous integration pipelines may unknowingly deploy tampered commits because their tooling still trusts the “Verified” badge. Mitigation requires both repository owners and platform providers to adopt stronger hashing primitives for commit signatures and to audit existing signed histories for potential collision artifacts. Until GitHub updates its verification logic to bind signatures directly to immutable hashes—ideally BLAKE3 or SHA‑256—the verified status remains a convenient but misleading indicator of authenticity.

The study also highlights a broader trend in software provenance: as more projects move toward declarative build systems and reproducible builds, the assumption that a cryptographic hash uniquely identifies source material must be revisited. While the vulnerability does not immediately allow arbitrary file replacement (the attacker still needs to match author data and timestamps), it opens a path for subtle tampering that could evade human review.

In short, GitHub’s current verification model cannot guarantee that a verified commit truly reflects the exact content originally signed; users should treat the badge with caution until the underlying algorithmic foundation is strengthened.