Re:What does a PGP signature on a Git commit prove?
by michaelt on Wednesday March 31, 2021 @03:49AM
(#26644529)
For text files, tools for brute forcing a git commit hash [1] work by messing with the author and committer timestamps.
Of course, that only gives you about 40 bits to play with (assuming the further you move the timestamp, the easier it is to detect) so it wouldn't be completely sufficient on its own.
Of course, that only gives you about 40 bits to play with (assuming the further you move the timestamp, the easier it is to detect) so it wouldn't be completely sufficient on its own.
[1] https://github.com/DesWurstes/VanityCommit#alternatives