A Git horror story: faking provenance with a loose nonce · HackerTrans