{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:NVMCE3WRXN2HXRA43SSYM2K7B7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"7dc43e78ab08400f5a703911aa81da2abd9700a1fc9e0f8ab22880bf60fa00a3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-02T23:19:37Z","title_canon_sha256":"291f390acd74a2b9506e2d76101f2a86317b721805773a2d1c1bcec8f5ab33ae"},"schema_version":"1.0","source":{"id":"2607.02820","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.02820","created_at":"2026-07-07T00:16:19Z"},{"alias_kind":"arxiv_version","alias_value":"2607.02820v1","created_at":"2026-07-07T00:16:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.02820","created_at":"2026-07-07T00:16:19Z"},{"alias_kind":"pith_short_12","alias_value":"NVMCE3WRXN2H","created_at":"2026-07-07T00:16:19Z"},{"alias_kind":"pith_short_16","alias_value":"NVMCE3WRXN2HXRA4","created_at":"2026-07-07T00:16:19Z"},{"alias_kind":"pith_short_8","alias_value":"NVMCE3WR","created_at":"2026-07-07T00:16:19Z"}],"graph_snapshots":[{"event_id":"sha256:92b1deeb0ed324e9c313113dc0929a9f4421f3a4380285f612cf1e0d27ecc25e","target":"graph","created_at":"2026-07-07T00:16:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.02820/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Git commit signing is widely entrusted to serve as evidence that a commit hash uniquely and immutably identifies a specific piece of signed content. We show this invariant does not hold. Given any signed commit, an attacker without access to the signing key, and without breaking SHA2 can produce a second, distinct commit with an identical tree, identical metadata, a valid signature, and a ``Verified'' badge from a Git Forge such as Github, differing only in its commit hash. The modified commit cascades to modify the values of all the subsequent, dependent commit hashes, hence we introduce the ","authors_text":"Jacob Ginesin","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-02T23:19:37Z","title":"Git Hash Chain Malleability"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.02820","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c2d75c87a4816b5d30332d945ad9298fbda42d8cbe6a835e504219238e464f20","target":"record","created_at":"2026-07-07T00:16:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"7dc43e78ab08400f5a703911aa81da2abd9700a1fc9e0f8ab22880bf60fa00a3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-02T23:19:37Z","title_canon_sha256":"291f390acd74a2b9506e2d76101f2a86317b721805773a2d1c1bcec8f5ab33ae"},"schema_version":"1.0","source":{"id":"2607.02820","kind":"arxiv","version":1}},"canonical_sha256":"6d58226ed1bb747bc41cdca586695f0fcbb04a4c09a68d572c89daffefec0f86","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"6d58226ed1bb747bc41cdca586695f0fcbb04a4c09a68d572c89daffefec0f86","first_computed_at":"2026-07-07T00:16:19.040637Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-07T00:16:19.040637Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"LbmWRnc0P7up12nYa1i1D3IO5qqvy/BwSBkxgwbDMEsuq4682tH99TiSVUOyZE96fD3JHIDCvqpbIvhm8wnqCA==","signature_status":"signed_v1","signed_at":"2026-07-07T00:16:19.041243Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.02820","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c2d75c87a4816b5d30332d945ad9298fbda42d8cbe6a835e504219238e464f20","sha256:92b1deeb0ed324e9c313113dc0929a9f4421f3a4380285f612cf1e0d27ecc25e"],"state_sha256":"32727a99957be046f9bc27e5e7cf00f4f7b3a5b2f8de47de10697daadc2fab89"}