Search code examples
gittrustauthenticity

Can a git history be falsified?

Could a git history be falsified?

I'm thinking for instance about the following informations :

  • Commit date
  • Commit content
  • Identity of commiter

If yes :

  • Are there ways to authenticate a git repo's content or make it authenticatable?
  • How to know if a git history was modified?
Solution

  • All the fields that you mentioned are part of the SHA-1 that is used to identify the commit. As such, it is impossible to change these fields without creating a new commit. And a new commit means, that no git implementation will accept the rewritten commit as a replacement for the original one, unless you force it to.

    Generally, when you have a git commit ID, that is a cryptographic hash of all the development history up to that point, and all the authorship information that includes. Any change of that data will be detectable.

    If you want extra security, you can sign-off commits with PGP keys using git commit -S.