Yep. You can inject arbitrary metadata into the git commit object and the git cli ignores it, other than including it in the hash. E.g., https://github.com/kevinwallace/gitbrute , https://github.com/kevinwallace/gitbrute/commit/0001111 .

Wow! I wouldn't have guessed that Git had that vulnerability. Fossil solves it easily: creating a new repo involves generating a random project code (a nonce) which goes into the hash of the first commit, so that even two identical commit sequences won't produce identical blockchains.

Fossil lets you force the project ID on creating the repo, but the capability only exists for special purposes.

It doesn't seem to be a vulnerability at all