How to verify Git commits are not altered by SHA-1 collisions?

Cover

Photo: Serpstat (CC0)

Spotlight

PAGE: https://alison.com/course/advanced-diploma-in-cryptography

PROMISE: Master the hash functions and MACs needed to detect altered code.

WHO: Software engineers who maintain secure release pipelines and need to audit cryptographic foundations.

WHYNOW: Legacy hash algorithms are being phased out, making collision resistance knowledge critical for secure code management.

DESC: Acquire a complete knowledge about online diploma for a cryptography training course that involves fundamental practices in securing computer systems and data.

BEFORE: You trust legacy hash outputs without verifying their collision resistance.

BEFORE: You cannot distinguish between a valid commit and a crafted malicious duplicate.

BEFORE: You lack a framework for authenticating data integrity in your pipeline.

AFTER: You evaluate hash functions based on their collision resistance properties.

AFTER: You identify malicious code variants through proper MAC verification.

AFTER: You implement authenticated encryption to secure and verify data integrity.

GAIN: The ability to design Message Authentication Codes using Hash Functions

GAIN: A clear understanding of Authenticated Encryption concepts

GAIN: Practical application skills for Padded RSA Public-Key Cryptosystem

STEP: You verify a commit signature but the SHA-1 digest collides with a malicious variant. || Design Message Authentication Codes using Hash Functions || You construct MACs that bind the code to its origin, preventing silent hash collision attacks.

STEP: You need to confirm the code integrity of a dependency without relying on broken legacy algorithms. || Explain the concept of Authenticated Encryption || You apply authenticated encryption standards to ensure data is both confidential and tamper-proof.

STEP: You are unsure which cryptographic primitives offer resistance against modern collision attacks. || Outline the applications of the Padded RSA Public-Key Cryptosystem || You select robust public-key schemes that secure the transport of your integrity checks.

NOTFOR: Developers who need immediate deployment of specific hash implementations today.

NOTFOR: Those who already hold professional certifications in advanced cryptographic standards.

FACT: Average duration: 20-30 Hours (Contains Video)

FACT: CPD-accredited certificate available

FACT: Advanced level

COVERS: Upon successful completion of this course, you should be able to:

COVERS: Outline the advanced applications of Cryptography

COVERS: Discuss the practical instantiations of Pseudorandom Generators

COVERS: Explain how to onstruct CPA-secure ciphers using pseudorandom functions

COVERS: Describe the theoretical and practical constructions of Block Ciphers

COVERS: Design Message Authentication Codes using Hash Functions

COVERS: Explain the concept of Authenticated Encryption

COVERS: Outline the applications of the Padded RSA Public-Key Cryptosystem

COVERS: List the properties of the Zero-Knowledge Proof Protocol

COVERS: Cybersecurity

COVERS: Information Security

COVERS: Cryptography

MODULE: Symmetric Key Cryptography || Introduction to Cryptography | Symmetric Key Encryption | Cryptanalysis of Historical Ciphers | Perfect Security | Limitations of Perfect Security

MODULE: Computational Security || Introduction to Computational Security | Semantic Security | Pseudo-random Generators | Operations on Pseudo-random Generators

MODULE: Pseudo-random Generators || Provably Secure Instantiation of PRGs | Practical Instantiation of PRGs | CPA Security | Pseudo-random Functions | CPA Secure Encryption from PRF

MODULE: Block Ciphers || Modes of Operations of Block Ciphers | Output Feedback Mode and Counter Mode | Theoretical Construction of Block Ciphers | Practical Construction of Block Ciphers | Data Encryption Standard Architecture | Passive and Active Adversary

MODULE: Message Authentication Codes || Message Integrity and Authentication | Message Authentication Codes for Long Messages | Block-wise Fully-Secure CBC | Information Theoretic Secure MACs | Construction of Information Theoretic Secure MACs

MODULE: Cryptographic Hash Functions || Introduction to Cryptographic Hash Functions | Constructing Fixed Length Compression Functions | Message Authentication Using Hash Functions | Hash Function Attacks and Applications | Random Oracle Model | Hash Functions in the Random Oracle Model

MODULE: Cyclic Groups || Introduction to Cyclic Groups | Cryptographic Hardness Assumptions | Candidate Cyclic Groups | Cyclic Groups based on Elliptic Curves | Discrete Logarithm Assumptions | Public-Key Cryptosystems

MODULE: Authenticated Encryption Schemes || Authenticated Encryption | Composing CPA Secure Cipher and Secure MAC | Other Approaches for Authenticated Encryption | Key Exchange Protocols | Generic Constructions of Key Exchange Protocol

What you are probably seeing

You check out a commit in your build pipeline and see the status as clean, but your automated tests start failing in weird ways that suggest the code logic changed even though the diff looks correct on the surface.

You notice that your vendor or upstream project still lists SHA-1 hashes for their release artifacts, while your security audit policy requires SHA-256 verification, leaving you without a way to prove the files you downloaded are unmodified.

Why it happens

SHA-1 collision resistance was publicly broken in 2017, meaning an attacker can craft two different files that produce the same hash value, so a matching SHA-1 sum does not guarantee the content is safe or unaltered.

Legacy Git repositories often rely on internal object addressing using SHA-1, which allows malicious blob manipulations to slip through if the system only validates the legacy checksum instead of a stronger cryptographic signature.

What changed recently

2026-10-06 · CVE-2026-105804: CVE-2026-105804: Insecure Default PBKDF2 Password Hashing Configuration in Payload CMS
Payload CMS updates default settings for that gap:
• Payload CMS versions 3.0.0 to 3.90.0 use insecure defaults.
• Attackers crack hashes 16 times faster than intended.
• CVSS score for CVE-2026-105804 is 5.7.
Source: how_devto_security

2026-10-06 · The Hash You Pick Matters: MD5, SHA-1, SHA-256, and What Each Is Still Good For
A new guide explains why skipping SHA-1 checksums opens security gaps:
• SHA-1 collision resistance was publicly broken in 2017
• SHA-256 checksum verification confirms byte-for-byte identical files
Source: how_devto_security

2026-10-06 · GitLab warns of critical AI Gateway vulnerability allowing command execution
GitLab is now providing critical patches for that gap:
• Critical vulnerability tracked as CVE-2026-90970 in GitLab AI Gateway
• Patched versions for self-hosted: 19.2.4, 19.3.2, and 19.4.1
Source: SC Media

2026-10-06 · GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration
GitLab is now under active exploitation for that gap:
• CVE-2026-85706 allows unauthenticated remote attackers to read arbitrary files
• Affects self-managed GitLab CE/EE 18.7 through 19.3.1
Source: infoq.com

Step by step

1. Run a SHA-256 checksum verification on all critical dependency downloads to confirm they are byte-for-byte identical to the trusted source.

2. Replace SHA-1 based integrity checks in your CI scripts with SHA-256 to ensure any tampering is detected by the build system.

3. Enable GPG signature verification for your repositories so commits are validated against a trusted key rather than just a hash value.

4. Audit your lock files and dependency manifests to remove references to SHA-1 hashes where tooling supports newer algorithms.

5. Test your verification workflow by intentionally introducing a one-byte change to a file and confirming the build fails on the SHA-256 mismatch.

Ways to go further

Start here: Advanced Diploma in Cryptography Open the free course on Alison ↗

Affiliate links: CHEAPUNO may earn a commission if you buy through them, at no extra cost to you.

Other problems readers raise

How to stop ClickFix and QR code phishing on mobile

Does your SSL monitoring catch downtime in seconds?

How to remove your domain from Uceprotect without paying fees?

How to check if your security covers AI attack patterns

How to check if your mobile provider can handle a data breach?