AI 中文总结
研究发现Git提交签名中提交哈希不能唯一且不可变地标识特定签名内容。攻击者可利用多种数据表示的固有可塑性产生具有相同树、元数据、有效签名的不同提交，介绍了三种实现途径及影响，并提供概念验证工具。
AI 中文摘要
Git提交签名被广泛认为能证明提交哈希唯一且不可变地标识特定签名内容。但本文表明此不变性不成立。无签名密钥且不破解SHA2的攻击者能产生具有相同树、元数据、有效签名及“已验证”徽章的不同提交，其哈希链可塑性源于组成提交的数据表示的固有可塑性，文中展示了三种实现途径及影响。
英文摘要
Git commit signing is widely entrusted to serve as evidence that a commit hash uniquely and immutably identifies a specific piece of signed content. We show this invariant does not hold. Given any signed commit, an attacker without access to the signing key, and without breaking SHA2, can produce a second, distinct commit with an identical tree, identical metadata, a valid signature, and a ``Verified'' badge from a Git Forge such as Github, differing only in its commit hash. The modified commit cascades to modify the values of all the subsequent, dependent commit hashes; hence we introduce the terminology ``hash chain malleability'' to describe this phenomenon. The malleability in signed Git hashes is feasible due to the inherent malleability present in many of the data representations that make up a commit. In this paper we show three such malleation routes: (i) algebraic inversion s -> n-s for ECDSA; (ii) structural insertion of an unhashed OpenPGP subpacket (RFC4880 5.2.3) for RSA and EdDSA; and (iii) non-canonical DER length re-encoding (X.690 10.1) inside the CMS envelope for S/MIME. Algebraic inversion for ECDSA signatures and subpacket insertion were found to pass local verification (git verify-commit), and all three methods yield a persistent, independent ``Verified'' record on Github. We discuss the consequences of Git hash chain malleation for hash-based commit blocking, dependency pinning (Nixpkgs, Go modules, Github Actions), and reproducible-build systems that treat the commit hash as a content-addressable primary key, and we provide proof-of-concept tooling that automates all three routes.
Comments5 pages
