gittrustauthenticity

Can a git history be falsified?


Could a git history be falsified?

I'm thinking for instance about the following informations :

If yes :


Solution

  • All the fields that you mentioned are part of the SHA-1 that is used to identify the commit. As such, it is impossible to change these fields without creating a new commit. And a new commit means, that no git implementation will accept the rewritten commit as a replacement for the original one, unless you force it to.

    Generally, when you have a git commit ID, that is a cryptographic hash of all the development history up to that point, and all the authorship information that includes. Any change of that data will be detectable.

    If you want extra security, you can sign-off commits with PGP keys using git commit -S.