GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures

Research shows signed Git commits can be re-encoded into fresh GitHub Verified hashes without changing files or breaking signatures.

Raccontata dathehackernews.com