Every commit object carries both fields, author and committer. You can inspect the raw commit object using the command-line git cat-file -p
operation. For instance:
$ git cat-file -p 83232e38648b51abbcbdb56c94632b6906cc85a6 | sed 's/@/ /'
tree 894962f72d565687c409f018060fdefa20e5f3fe
parent aa8c8d914e4ae709e4fd025f359594f62653d9e5
author Junio C Hamano <gitster pobox.com> 1556175832 +0900
committer Junio C Hamano <gitster pobox.com> 1556178085 +0900
The seventh batch
Signed-off-by: Junio C Hamano <gitster pobox.com>
Once a commit is made, it cannot be changed: the hash ID of the commit, in this case 83232e38648b51abbcbdb56c94632b6906cc85a6
, is a cryptographic checksum of the contents of the commit. If I took this text, changed the names, and made a new commit from the result, I'd get a different commit hash ID.
Now, I could do that, and having done that, I could then copy all the immediate downstream commits—all the children of 83232e38648b51abbcbdb56c94632b6906cc85a6
—to new and different commits that have my new commit as their parent(s). Then I'd have to copy those commits' children, and their children's children, and so on, all in an effort to make you believe that my copy of 83232e38648b51abbcbdb56c94632b6906cc85a6
is the copy you should use. If there are any signed commits, or signed annotated tags, in this copied chain, I'd be unable to sign them properly unless I had Junio Hamano's signing key. So you might be able to tell that I did this—and even if there aren't any signing keys, you'd probably still be able to tell, because the Git repository I offered to you, with these copied replacements, would not match the copy you'd picked up earlier, with the originals in it.
So, the fact that the merge has Alice's name on it—assuming your GUI is not lying to you—means that the merge has Alice's name on it. That doesn't mean that Alice actually made it, as Bob could have set his Git up to claim to be Alice for the duration of Bob making the merge. If you want to verify who made the commit, you'll need some kind of digital signature as well, either on the commits, or on annotated tags. (Signing each commit is a big pain, which is why the Git developers only sign their annotated tags.)
Why and how this happened is not something we can guess. It's up to you whether to believe Bob when he says that he did not do it as a prank. You'll have to observe it actually happening and investigate from there.