You’ve probably seen that little green ‘Verified’ badge next to a Git commit. It feels safe. It feels like proof. But what if that badge is nothing more than a digital participation trophy? We treat it as the ultimate seal of authenticity, but the reality is far more unsettling.
A cryptographic signature is only as honest as the math beneath it, and the math beneath Git commits is quietly bending.
Developers and security teams treat signed commits as the ultimate audit trail. If it’s signed, it’s authentic. If it’s signed, nobody tampered with it. We built entire supply chain security models on this assumption. But here’s the twist: the hash that Git uses to identify a commit is computed over the entire commit object. That includes the commit message, the author metadata, and the timestamps.
This means the underlying hash is malleable. If an attacker knows what they’re doing—say, exploiting ECDSA nonce reuse or weak hash truncation—they can alter the content of a commit while preserving the signature. The badge stays green. The history changes right under your nose.
We didn’t build a tamper-proof vault; we built a glass box with a very expensive lock on the outside.
Think about what this means for your organization. You’re relying on these signatures for code provenance. You need to prove who wrote what and when. But if the signature can be repudiated or altered without detection, your audit trail is a mirage. You’re not securing your history; you’re just decorating it with false confidence.
The real danger isn’t the vulnerability itself. It’s the false sense of safety it creates. When you believe a system is bulletproof, you stop checking for bullet holes. We assume that cryptography equals truth, forgetting that cryptography is just a set of rules—and rules can be bent by anyone who understands the exceptions.
Trust isn’t a green badge you display; it’s a threat model you constantly question.
Stop treating signed commits as the final word on integrity. Start questioning the underlying mechanisms of your version control. Because in the world of code, a verified checkmark doesn’t mean you’re safe. It just means you haven’t been caught yet.
FAQ
Q: But doesn't the 'Verified' badge mean the commit hasn't been changed?
A: No. The badge only means the signature matched the commit object at the time of verification. Because the hash covers mutable metadata like timestamps and author info, a skilled attacker can malleate the commit and keep the signature valid.
Q: What's the practical implication for my engineering team?
A: You cannot blindly trust signed commits for absolute code provenance or supply chain security. If an audit trail relies solely on these signatures, it is vulnerable to being rewritten without triggering alarms.
Q: Is signing commits completely useless then?
A: Not useless, but dangerously over-hyped. It protects against casual tampering, but against a sophisticated attacker targeting signature algorithm flaws, it provides a false sense of security. Treat it as a deterrent, not a guarantee.