[kibwen]

The git hash surely also takes the contents of binary files into account, so I imagine that in any repo that contains non-text files, an attacker would try to hide the garbage inside e.g. some metadata field of an image file.

[db48x]

That's true. PDFs and other document formats are also great because you can include large volumes of data that is never used in the final output.