Post #1575128

2026-04-22 17:30 UTC

Hey Security friends: Does git commit signing matter? I feel like I don&#39;t see it used in production as much as I would expect, and I also don&#39;t see a big push on it from the wider sec community. Do we care?

Replies (3)

@JensHannemann@mastodon.online 2026-04-22 17:38

@phildini I use gitolite with SSH public keys only. In this scenario, a commit with a specific user ID is essentially proof of identity, so signing is kind of useless. Signing off on a commit indicating approval is a bit more useful. So in my opinion signing commit only makes sense in scenarios where access credentials not necessarily provide identity (e.g. username/password).

Open ##1579420
@aschmitz@ostatus.lardbucket.org 2026-04-22 17:39

@phildini In the abstract, assuming no need for deniability, having it is better than not having it, but as with most things it comes down to your threat model. If you don't trust your Git repository host to not tamper with things, then it's useful. If you only sign with touch-activated Yubikeys and validate it before deploys, it could be useful. If you sign with the same SSH keys you auth to GitHub with, and you trust GitHub and have your accounts there locked down, it doesn't get you much.

Open ##1579421
@amethyst@toots.n7.gg 2026-04-22 19:41

@phildini I still sign my tags, but not commits, mostly because I want the ability to treat SSH keys/machines as ephemeral, and don't want to deal with unlocking my keychain for every single commit. IMO it's the final "release artifact" that matters more than the incremental work.

Open ##1579429