Git commit signatures can be reshaped without breaking GitHub’s Verified badge
Researchers prove a signed Git commit can be altered to a new hash while keeping a valid signature, so GitHub still shows the 'Verified' badge. The flaw uses signature malleability in ECDSA, RSA/EdDSA OpenPGP subpackets and DER encoding, breaking the belief that commit hashes are immutable. It endangers dependency pinning, reproducible builds and supply‑chain defenses that rely on hashes.