It's easier than that. Someone could create a benign patch and a malicious patch that collides the hash. But what could they do with that? For example, let's s

It's easier than that. Someone could create a benign patch and a malicious patch that collides the hash. But what could they do with that? For example, let's say it goes (letter##number represents the hashes): State 1: Real repo: R3 -> R2 -> R1 -> R0 (note: R3 is the head) Benign PR: B1 -> B0 -> R1 Malicious PR: M1 -> M0 -> R1 (note: M0 = B0, but the contents are different) State 2, after merging Benign PR: Real repo: R4 -> R3 -> R2 -> R1 -> R0, R4 -> B1 -> B0 -> R1 If Malicious PR was merged now, Git would, I imagine, just believe that M1 is a commit that branched off of B0, since that's where the "pointer" is at. So, yeah, what would this actually accomplish?