Hacker News Reader

Given a git repo with signed commits I can give you the same repo with some file(s) changed with the signatures intact.

Pretty sure you can anyway, I haven't thought deeply about the git file formats involved and such.

Note that this attack isn't _that_ serious. There's not a lot of cases where this would make sense.

I don't think so, unless you utilize some not-yet-public vulnerability.

As far as I know, with current public SHA-1 vulnerabilities, you can create two new objects with the same hash (collision attack), but cannot create a second object that has the same hash as some already existing object (preimage attack).

My bad, yep you're right. So you could only either give 2 people different git repos that should be the same or I guess you could submit a collided file into a repo you can submit changes to (eg a public one that accepts PRs) and give someone else the other version.

Given the limitations, really not too practical.

Reply on news.ycombinator.com