BREAKING: New research shows you can copy any signed GitHub commit into a second one that looks identical, without the author’s secret key, creating a distinct commit with an identical tree, identical metadata, a valid signature, and a “Verified” badge from GitHub.

On GitHub, a green “Verified” badge is supposed to mean two things: a trusted author signed it, and its ID is a one-of-a-kind fingerprint for that exact code. A new Carnegie Mellon preprint from Jacob Ginesin says the second promise, the unique fingerprint, does not hold.

Why it matters: security teams and package systems (behind tools like Go, Nix, and GitHub Actions) trust that ID as a unique handle for code. Block or pin the “bad” version, and an attacker can re-issue the same signed code under a fresh, still-verified ID that slips past. The author says Git and GitHub have not fixed it.

PoC: https://github.com/JakeGinesin/git-chain-malleator…

JakeGinesin/git-chain-malleator

Source: https://github.com/JakeGinesin/git-chain-malleator

Git Hash Chain Malleability

Malleate the hash chains in your Git repositories using the malleable signatures on Git commits!

This repo provides a Nix flake wrapping interactive-malleator.py and setup-ghost.py with per-algorithm test cases. Each test sets up a $GNUPGHOME (or self-signed X.509), produces a signed commit, runs the malleator, and asserts the expected invariants.

layout

.
├── flake.nix
├── scripts/
│   ├── interactive-malleator.py     # GPG:  ECDSA / RSA / EdDSA
│   └── setup-ghost.py               # S/MIME: CMS DER length re-encoding
└── tests/
    ├── lib.sh                       # shared: gpg setup, key gen, signed repo
    ├── test-ecdsa.sh                # NIST P-256 -> algebraic s -> n − s
    ├── test-rsa.sh                  # RSA-2048   -> structural Tag 60
    ├── test-eddsa.sh                # ed25519    -> structural Tag 60
    ├── test-smime.sh                # CMS/X.509  -> DER length re-encoding
    └── run-all.sh

usage

nix develop                    # dev shell (python3, git, gnupg, openssl)
bash tests/run-all.sh          # run all the tests

bash tests/test-ecdsa.sh       # single algorithm
bash tests/test-rsa.sh
bash tests/test-eddsa.sh
bash tests/test-smime.sh

# interactively malleate GPG-signed commits in your repo! 
python3 scripts/interactive-malleator.py \ 
    --repo /path/to/your/repo  

nix flake check only sees files tracked by git, so git add . before running it.

expected results

Each test asserts the local-side row of that table plus:

• malleated hash != original hash
• tree hash preserved (content-identical)
• for S/MIME: byte-diff confined to the gpgsig header

notes for maintainers

• Nixpkgs / any hash-pinning system: trust in hash(commit) as a unique handle is likely unreliable; the same signed content produces N valid Verified hashes
• git-verify-commit callers: strict local verification catches structural malleation (RSA/EdDSA/S-MIME) but not ECDSA algebraic malleation. Pin to hash-based deduplication downstream of verification, not upstream.
• CI/CD, Go proxy, Docker refs: same concern: commit hash is not a content-addressable primary key under a compromised signer or a malicious mirror.