• •International Cyber Digest reports that GPG-signed GitHub commits do not uniquely identify the underlying code content.
• •A researcher demonstrated that two different code patches can yield the same cryptographic signature when certain metadata is manipulated.
• •The scope of this vulnerability remains uncertain, specifically whether GitHub's backend verification protocols can be reliably patched without breaking existing repository histories.

Researchers have demonstrated that GitHub commits marked as 'verified' do not guarantee the uniqueness of the code changes associated with them. While GPG signatures are standard for identity verification, the current implementation fails to bind the signature to a strictly unique state of the codebase. This allows for scenarios where a verified signature can be technically decoupled from the specific changes it was intended to authenticate. Security teams now face a potential trust gap in automated audit logs that rely on commit verification as a singular source of truth.