Can you really impersonate anyone via git commits?

Question

If you set your repo config to some fake info:

[user]
    name = Bill Gates
    email = [email protected]

And push commits, the commit on Github show the name and email as the identifier for the commit.

Surely, this opens impersonation issues. Am I missing something?

From my understanding: If you have permission to push commits to a repo, you can technically impersonate anyone.

Am I correct in thinking this?

Answer 1

The original workflow that was used with Git, and one that is still used by Git and Linux, is a patch-based workflow. In this workflow, you send a patch with your name and email address, and people respond to your email to comment on it, and at some point, the maintainer applies the patch to their tree.

In such a case, having the ability to push commits with arbitrary author and committer information is important. The maintainer may well modify your patch slightly to make sure it applies on top of other code, so a digital signature over the contents of the patch might not be helpful. If your email were invalid, then the maintainer would not be able to email you, and you wouldn't respond to feedback, and nobody would apply your patch.

And of course you can specify a (nearly) arbitrary name. Git has no way to know what your name is, and GitHub would only know what name is on your credit card (if you're a paying customer) or your tax paperwork (if you're a recipient in GitHub Sponsors). Your credit card may or may not contain your legal name (think about a celebrity who goes by a stage name) and many people customarily go by a name (e.g., a middle name, shortened name, or nickname) that isn't their legal name, anyway, in addition to various other reasons someone might choose to use a certain name.

So, yes, you can embed arbitrary names and email addresses in the commit. If you'd like to prevent people from tampering with your commits, then you should end up signing your commits. If you do so, you can have GitHub mark any unsigned commits as explicitly unverified in the appropriate settings page.