Git & GitHub Interview Question #128
What is commit signing and why is it used?
Security, Team Workflows, Troubleshooting & Senior Git/GitHub Scenarios Senior Advanced
Quick Interview Answer
Commit signing adds a cryptographic signature to a commit so a hosting platform or another user can verify that the commit was signed by a key associated with the claimed signer. Git supports signing mechanisms configured by the developer, including supported GPG, SSH, or S/MIME workflows.
Detailed Explanation
Commit signing adds a cryptographic signature to a commit so a hosting platform or another user can verify that the commit was signed by a key associated with the claimed signer. Git supports signing mechanisms configured by the developer, including supported GPG, SSH, or S/MIME workflows.
Signing improves provenance but does not prove that the code itself is correct or safe. Organizations may combine signed commits with protected branches, reviews, and CI checks.
Code Example
# Example: create a signed commit after
# signing has been configured
git commit -S -m "Add secure configuration"
# Show signature information
git log --show-signature -1