People use the SHA1 hash when signing commits. If you can create collisions you can create repositories with arbitrary code without breaking the signature. See

People use the SHA1 hash when signing commits. If you can create collisions you can create repositories with arbitrary code without breaking the signature. See Github's blog post on the mitigations for more details: https://github.com/blog/2338-sha-1-collision-detection-on-github-com https://github.com/blog/2338-sha-1-collision-detection-on-gi...