Yes, they could, but that's not exciting (that's really what `git --amend` and `git rebase` are, after all). What's interesting from an attacker point of view i

Yes, they could, but that's not exciting (that's really what `git --amend` and `git rebase` are, after all). What's interesting from an attacker point of view is changing the contents of the file (in a meaningful way) without changing the hash. That way anyone who pulls from you gets a different copy of the code, but they won't easily discover if since the hash is the same as the original copy. Think about what happens if you were to fork a copy of something on github and then rebase to edit one of the commits. If I pulled from your copy and the pulled from the official repo I'd get a merge (and probably some conflicts) because git identifies commits by their sha and uses that to decide what needs to be merged. But if you managed to change one of your commits without changing the sha, then I'd have a much harder time detecting it, since when I pulled from another repo later there would be no merge (even though things were actually different).