GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures

Summary: Research by Jacob Ginesin, a PhD student at Carnegie Mellon University and cryptographic auditor at Cure53, shows that anyone without a signing key can create a second Git commit with identical files, author, and date, and a valid signature that GitHub still marks "Verified" - but with a different hash. The cause is signature malleability: a commit's hash covers the raw signature bytes, and many signatures can be rewritten into another valid form, so Ginesin's public tool runs three attacks covering every GPG scheme GitHub verifies plus S/MIME, with two demo repositories where the altered commits still show "Verified."
What's compelling: Any control that blocks, deduplicates, or logs provenance by commit hash - a blocklist, a provenance log, a reproducible-build record - can be bypassed by re-pushing the same content under a fresh, still-"Verified" hash it has never seen, and Ginesin says he reported the issue to GNU and Git in January and to GitHub in March, with neither Git nor any forge having addressed it as of publication.

Read the original at The Hacker News ↗