GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures

Research reveals that GitHub's 'Verified' commits can be altered to create new hashes with identical files, author, and date while maintaining valid signatures. This undermines the assumption that a commit's hash is unique, as GitHub still verifies the altered commit despite the hash change.