GitHub verified commits can be rewritten to new hashes without losing signature

Colleagues, I’d like to draw your attention to a cybersecurity finding: research has shown that a signed commit in GitHub can be rewritten to a new hash while retaining its Verified status.

What this means:
• the content, author and date remain the same;
• only the signature representation changes, and therefore the hash;
• hash-based blocking, deduplication and provenance logs may let such a variant pass.

Importantly, this is not a signature-validation bypass and not a SHA-1/SHA-256 collision. It is a matter of signature malleability and how forge interprets Verified.

Why it matters: if a system trusts only the verified commit hash, the same code may appear as different objects.

How do you account for this in your supply chain?
#cybersecurity #GitHub #DevSecOps #SupplyChain