Git commit signing serves as evidence that a hash uniquely identifies signed content. The paper demonstrates this assumption fails. An attacker, lacking the signing key and without breaking SHA‑2, can generate a distinct commit that shares the same tree, metadata, and a valid signature, while only its hash differs.

Three malleation routes are shown. Algebraic inversion s → n‑s for ECDSA signatures passes local verification. A structural insertion of an unhashed OpenPGP subpacket works for RSA and EdDSA. A non‑canonical DER re‑encoding inside the CMS envelope enables re‑encoding for S/MIME. All three methods produce a commit that GitHub marks with a Verified badge.

The attack cascades, updating all downstream commit hashes and breaking hash‑based lock‑downs used in dependency pinning, reproducible builds, and hash‑based commit blocking. Proof‑of‑concept tooling automates the three routes, allowing developers to re‑create the scenario.

The findings expose a blind spot in tools that treat the hash as a content address. Systems relying on hash immutability must consider additional checks, such as signature metadata validation or alternative integrity markers. Defenders should audit their pipelines for this vulnerability and update trust models accordingly.