<story><title>What does a PGP signature on a Git commit prove?</title><url>https://people.kernel.org/monsieuricon/what-does-a-pgp-signature-on-a-git-commit-prove</url></story><parent_chain></parent_chain><comment><author>rakoo</author><text>&amp;gt; The difference between signed tags and signed commits is minimal — in the case of commit signing, the signature goes into the commit object itself. It is generally a good practice to PGP-sign commits&lt;p&gt;Note: Linus says otherwise, the two are very different: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;git.661346.n2.nabble.com&amp;#x2F;GPG-signing-for-git-commit-td2582986.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;git.661346.n2.nabble.com&amp;#x2F;GPG-signing-for-git-commit-t...&lt;/a&gt;&lt;p&gt;One of the most important reasons it doesn&amp;#x27;t make sense to sign commits is that keys expire so when you sign something you implicitly say it is valid at most until the key is valid; nothing can be guaranteed after that. It is easy enough to re-sign a tag (even automatically) but you can&amp;#x27;t re-sign a commit without changing its identity and that defeats the whole purpose of git.&lt;p&gt;The only reason you&amp;#x27;d want to sign commits is to defend from malicious maintainers ie if your patch is changed before being merged, or your authorship is removed, or a patch impersonating you is merged. It&amp;#x27;s probably better to sign your patches (ie the temporary moment where you interact) in that case: I see there was some work in that direction (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;lwn.net&amp;#x2F;Articles&amp;#x2F;813646&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;lwn.net&amp;#x2F;Articles&amp;#x2F;813646&amp;#x2F;&lt;/a&gt;) but apparently it hasn&amp;#x27;t caught up (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;signatures&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;signatures&amp;#x2F;&lt;/a&gt; shows last signatures end of 2020)</text></comment>
<story><title>What does a PGP signature on a Git commit prove?</title><url>https://people.kernel.org/monsieuricon/what-does-a-pgp-signature-on-a-git-commit-prove</url></story><parent_chain></parent_chain><comment><author>nerdponx</author><text>&amp;gt; If we cared to, we could walk each commit all the way back to the beginning of Linux git history, but we don&amp;#x27;t need to do that — verifying the checksum of the latest commit is sufficient to provide us all the necessary assurances about the entire history of that tree.&lt;p&gt;Doesn&amp;#x27;t this imply a tremendous amount of trust in the signer? It sounds like it&amp;#x27;s only a guarantee about history if &lt;i&gt;every&lt;/i&gt; commit was signed.</text></comment>