Git commit signatures seems the signature signs the commit message, but I can't find much information on what the signatures actually solve, and don't understand the git architecture.

If I have a repository which began unsigned but moved to a signed model, can a malicious user with write access perform any of the following tasks without invalidating the latest signature:

  • Modify data committed with a signed commit message
  • Modify data prior to the first signed commit in a way that results in the latest commit being different (Eg modify a part of the code that signed commits do not touch, meaning they won't create any diffs which overwrite the maliciously modified component)

Both of those things are impossible, unless they can break SHA1 (which is currently vulnerable only to collision attacks, not preimage or second preimage attacks, so they would have had to trick the legitimate user into accepting a dodgy binary file). And that's exactly the point of commit signing; if it didn't prevent those things, it would be worthless.

  • Could you expand on how (or more what) it signs commits in a way that prevents collision attacks? – throwaway124215 Sep 5 '19 at 3:42
  • 1
    @throwaway124215 My point is that it doesn't. The weaknesses in SHA1 would theoretically allow such an attack against signed Git commits. It's a weakness in an otherwise strong system. – Joseph Sible-Reinstate Monica Sep 5 '19 at 4:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.