The PDF's released as proof are the same size, so if size and checksum are the same, git could certainly be fooled at checkout time. So I could imagine in a la

The PDF's released as proof are the same size, so if size and checksum are the same, git could certainly be fooled at checkout time. So I could imagine in a large source file, it would be possible to have some malicious code plus some data in comment blocks to make the hash match. That said, the PDF's are 422k, and I think it's a much more difficult attack on more typical, smaller size source files that one would typically check out and build from git. Maybe Xcode .nibs and that sort of tool output could become relatively easy attack vectors, though.