git-evtag

If anyone is really interested in more assurance of git commit contents, there's "git-evtag", which does a sha-512 hash over the full contents of a commit, including all trees and blob contents. https://github.com/cgwalters/git-evtag

Regarding tags, https://github.com/cgwalters/git-evtag seems like a really interesting idea.

A scheme to generate (and sign) a SHA512 hash that more directly incorporates the full state of the repo was invented, and is used by some projects incl. nodejs https://github.com/cgwalters/git-evtag https://github.com/nodejs/node/issues/7579 I personally think it's overkill

The main problem is relying on Git's SHA1s for security. Git was not designed for security - it was a nice side effect while SHA-1 was dependable. But it isn't any more; a method for finding freestart collisions ("SHAppening" [0]) is already known, and it is expected that standard collisions will be found within a year. (Preimages are not expected for a few decades or hundred years though) For the use described here, however - proving to someone else that you had a specific repository content - collision availability renders a proof useless. Similarly, for this specific use, Git's standard support for PGP signatures is also useless - you can use a 4,096 bit RSA signature, but it only guarantees a 160-bit SHA1 hash, which (given collisions) is not dependable as a proof. If you really need it, you need something else - use an SHA2 or SHA3 v