2

I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata?

How could I manually duplicate the signature, use gpg instead of git?

flickerfly
  • 133
  • 7
  • 1
    This post goes into these details: https://people.kernel.org/monsieuricon/what-does-a-pgp-signature-on-a-git-commit-prove – mricon Jan 15 '21 at 14:44

1 Answers1

5

I took a look at the function "commit_tree_extended" in the git source code for the file "commit.c" (e.g., in this blob).

Based on reviewing this function, when you sign a commit it seems to be signing a string that contains identifiers for the tree object_id, parent object_id, author, committer, encoding (if not utf-8), commit_extra_header, and the commit message.

Jörg W Mittag
  • 1,190
  • 7
  • 11
hft
  • 4,910
  • 17
  • 32