GitHub Verified Commit Hashes Malleable via ECDSA, RSA, and S/MIME Signature Rewrites

The attacks exploit signature malleability across all schemes GitHub accepts. ECDSA permits flipping s to n-s; RSA and EdDSA allow ignored fields in the unhashed section; S/MIME permits non-canonical DER length encoding. Each produces a distinct commit object that passes both local verification and GitHub's badge. The tool also rewrites parent hashes to preserve chain consistency while keeping descendant signatures intact until their own pointers change.

Evidence comes from Ginesin's five-page paper, two demo repositories, and direct reproduction against GitHub's live forge. This matches the exact ECDSA symmetry Bitcoin addressed with low-S enforcement years earlier, yet GitHub performs no normalization or re-verification on revocation. Mainstream coverage stopped at the mechanism and missed the supply-chain consequence: reproducible-build records, deduplication caches, and mirror provenance keyed to commit hashes become unreliable.

Operational impact is immediate for any system treating a verified hash as a stable name. A hostile mirror or compromised CI can serve alternate hashes that still appear signed and identical in content. The fix is forge-side canonicalization of signatures before hashing and verification; no repository changes are required. Absent that, block-by-hash policies and SBOM provenance trails inherit a permanent bypass.

Next steps hinge on whether GitHub or competing forges adopt strict signature rules within the next release cycle.