git-wormhole

git-wormhole is a tool for generating partial commit hash collisions. You can see an example here.

Installation

go install github.com/tncardoso/git-wormhole/cmd/git-wormhole

Examples

There are two strategies available for finding a collision: changing the author/commit time or adding a suffix to the commit message. You will need to provide two files, the template and target. The template is a golang format template. The Target is the file that will be generated by rendering the template. An example template would be:

version = "{{ .Prefix }}"

Running git-wormhole with a 0000 prefix would result in the following file:

version = "0000"

Using the 'comment' strategy

$ # inside the repository you want to generate a collision
$
$ git-wormhole -strategy=comment -prefix=0000 FILE.template TARGET
...
...
Found collision.
Run the following command:

GIT_AUTHOR_DATE="raw:1616871477 -0300" GIT_COMMITTER_DATE="raw:1616871477 -0300" git commit -a -m 'git-wormhole
119798'

Using the 'time' strategy

$ # inside the repository you want to generate a collision
$ # if no collision is found, you can increase the allowed jitter
$
$ git-wormhole -strategy=time -prefix=0000 FILE.template TARGET
...
...
Found collision.
Run the following command:

GIT_AUTHOR_DATE="raw:1616871509 -0300" GIT_COMMITTER_DATE="raw:1616871279 -0300" git commit -a -m 'git-wormhole'

Usage

$ git-wormhole -h
Usage of git-wormhole:
  git-wormhole TEMPLATE TARGET

  -comment string
    	comment that should be used on commit (default "git-wormhole")
  -delta int
    	max time change in author date in seconds (default: 6 hours) (default 21600)
  -diff int
    	max difference between author and commit dates (default: 1 hour) (default 3600)
  -prefix string
    	git commit hash prefix
  -strategy string
    	[comment|time] (default "time")
  -tests int
    	maximum number of tests in comment strategy (default 2147483648)
  -version
    	show version

Limitations

• The repository should be clean, with no unstaged changes.
• The target file should already exist.