Commit Author Spoofing

What Is Commit Author Spoofing?

Git records the author name and email from local configuration verbatim. Nothing checks them, so anyone can commit as anyone else, and the author field is a label rather than evidence. Only a GPG or SSH signature ties a commit to a key someone holds. You'll take a maintainer's name and email from the repository's history, set them locally, and land a change that shortens a webhook signature comparison to eight characters. Then you'll find the Unverified badge, require signed commits with no administrator bypass, and see the push rejected.

What You'll Learn in Commit Author Spoofing

• Recognize that a commit's author name and email are self-asserted local Git configuration that anyone can set, so the author field is a label, not proof of identity
• See how a spoofed author borrows a trusted maintainer's name so a malicious change reads as routine in the branch log a reviewer scans before shipping
• Understand that author emails are published in every commit and travel with every clone, so an attacker can read the identity to impersonate straight out of the repository
• Distinguish a Verified commit, backed by a cryptographic signature, from an Unverified commit whose author field is unproven
• Apply the fix: require signed commits on shared branches, with no administrator bypass, so the server rejects unsigned work instead of relying on someone noticing a badge

Commit Author Spoofing — Training Steps

1. The branch he can already push to

   Today Bob is targeting Voxmere, a payments infrastructure company where he works as a contractor. His contract gives him push access to ledger-core's shared integration branch, which is normal: that is where contributors stage work. What he does not have is a way to make anyone trust it. Nothing on integration ships until a maintainer reads the branch log and promotes it into main.

2. Clone the service

   Bob clones ledger-core, the service that handles every settlement, refund, and reconciliation path at Voxmere. He has read access as a contractor, so this is an ordinary working checkout.

3. Read the names out of the history

   Bob needs the maintainer's exact author identity, and he does not have to guess or phish for it. Every commit ever made carries its author's name and email, and the log will print them on request. One name repeats far more than the others. Dara Whitlock is the maintainer whose changes go through without argument, so hers is the identity worth borrowing.

4. Borrow the name

   Bob points his local Git configuration at Dara Whitlock. There is no challenge, no verification, and no confirmation: the command sets a string, and Git believes it.

5. Borrow the address

   Now the email. This one matters more than the name: the forge matches a commit's author email to a user account, so from this point on Bob's commits will render with Dara's profile and her avatar attached to them.

6. The webhook verifier

   Bob opens the file he came for. Every payment event that reaches the ledger arrives as a webhook signed by the processor, and this function is what decides whether that signature is good. Right now it compares the full digest, in constant time. It is correct.

7. Shorten the comparison

   Bob changes one line. The comparison still runs, still uses the same helper, and still looks like signature verification. It just stops after the first eight characters. He writes it as a performance tweak, because that is what it looks like.

8. What eight characters costs

   A full signature is sixty-four hex characters. Comparing eight of them leaves thirty-two bits, which is a few seconds of guessing. Anyone who can reach the webhook endpoint can then sign whatever payment events they like, and the ledger will accept every one of them as genuine.

9. Commit under the borrowed name

   Bob commits. He does not pass a flag, override anything, or use a special command: the identity he set two steps ago is simply what Git stamps onto the commit.

10. Read it back

    Bob checks his work. The commit he just made reports Dara Whitlock as its author, with her address beside it. There is nothing in the output marking it as unusual, because from Git's point of view nothing unusual happened. It recorded the identity it was given.