GitHub Verified Commits Rewritten Without Breaking Signatures: Implications for Enterprise Security

GitHub recently disclosed a subtle yet powerful attack vector that allows threat actors to rewrite commit history in a repository while still presenting a verified signature. The phenomenon exploits the way Git’s signing mechanism validates the content of a commit at the time of signing, not the final hash that appears after rewriting. For enterprises that rely on signed commits as a cornerstone of auditability and supply‑chain trust, the revelation demands immediate scrutiny.

Understanding Git Commit Signatures

When a developer enables GPG signing for their Git workflow, each commit carries a cryptographic signature that binds the commit’s author, timestamp, and payload to a private key. Verification programs — such as git verify‑commit or GitHub’s UI badge — check that the signature matches the current commit object. However, Git permits rewriting history through commands like git rebase or filter‑branch, which create new commit objects with fresh SHA‑1 values while leaving the original signature metadata intact.

The Vulnerability: Rewriting Commits While Preserving Signatures

The attack works by exporting a signed commit, altering its tree or message, and then recombining the modified payload with a freshly computed hash that still satisfies the original signature verification rules. Because the signature is calculated over the commit’s *header* and *payload* structure, an adversary can preserve the Verified label on GitHub even after the underlying content changes. This means that a tampered commit can masquerade as authentic if only the signature verification step is performed, bypassing naive integrity checks.

Why It Matters to Modern Organizations

Enterprises that adopt signed commits to enforce non‑repudiation, regulatory compliance, or secure CI/CD pipelines are particularly exposed. A compromised commit can inject malicious build scripts, embed backdoors, or propagate supply‑chain vulnerabilities without triggering alerts. Moreover, the technique can be chained with automated merge bots, allowing an attacker to silently rewrite thousands of commits across multiple branches, eroding trust in the entire version‑control history.

Actionable Mitigation Strategies

Below is a concise checklist that IT administrators and security engineers can implement immediately to safeguard Git repositories against this subtle rewrite attack.

• Enforce Full Signature Validation in CI/CD: Ensure every pipeline step runs git verify‑commit --strict, which checks both the signature and the exact hash before proceeding.
• Adopt Signed Tags for Release Artifacts: Tag released versions using annotated tags (git tag -s), then verify the tag signature before deployment.
• Leverage Git Server‑Side Hooks: Deploy server‑side pre‑receive hooks that reject pushes containing commits with valid signatures but altered payloads.
• Audit Commit Metadata Regularly: Schedule periodic audits that compare the hash stored in the signature with the current commit SHA, alerting on mismatches.
• Disable Untrusted Rebase Operations: Restrict developers from using interactive rebase on protected branches and enforce merge‑only workflows where possible.
• Enable GPG Key Rotation & Revocation Policies: Monitor key expiration dates, rotate keys proactively, and maintain a revocation list that is checked during verification.
• Implement End‑to‑End Code‑Signing Frameworks: Use tools like signify or cosign that sign artifacts independently of Git metadata, providing an additional verification layer.

Conclusion

In summary, the ability to rewrite Git commits into new hashes without breaking the Verified signature label underscores a critical gap in naïve trust models that rely solely on cryptographic signatures. By integrating rigorous verification steps, embracing immutable tagging practices, and leveraging independent signing mechanisms, organizations can restore confidence in their Git history and protect their software supply chain. Professional IT management that embraces these advanced security controls not only mitigates current threats but also fortifies the organization against future covert tampering.