Practical (and impractical) git commit signing

on YouTube ↗30m

" summary

Argues that commit signatures can give provenance but real tooling breaks the assurances; demonstrates working code and CI checks (links and repo provided) and recommends SSH certificates over GPG or S/MIME because they allow a single CA, short‑lived certs and easy agent signing. Describes Git shelling out to external signers, GitHub marking commits via GitHub's verified flag that trusts user‑added keys or global CAs only, and favors hardware-backed keys for organizational device attestation.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 1:02Speaker background
3. 2:27Why sign Git commits
4. 5:59GPG signing limitations
5. 9:54X.509 certificate issues
6. 13:28SSH keys for signing
7. 17:27GitHub commit validation
8. 21:24Enterprise key management
9. 24:57SSH certificate advantages
10. 26:42CI verification setup
11. 27:43Q&A

" related talks

• 34mSafe and Signed Git Commits with PGPThomas Qvidahl · Open Source Summit Europe 2022
• 29mIdentity-based Source Integrity with GitsignBilly Lynch · cdCon + GitOpsCon 2023
• 37mGitsign – Keyless Git Commit SigningBilly Lynch · SupplyChainSecurityCon at Open Source Summit Europe 2022
• 06mKeynote: Signing Git Commits with GitsignPriya Wadhwa · SigstoreCon North America 2022
• 05mIgnite – Konstantin RyabitsevKonstantin Ryabitsev · DevOpsDays Montreal 2018
• 10mSource Attestations with GitsignBilly Lynch · Cloud Native SecurityCon North America 2022
• 49mProtect Your Code with GitHub Security FeaturesRob Bos · GOTO Aarhus 2023
• 25mProving Trust: Signed Supply Chains and Verifiable Deployments at the EdgeSheldon Lo-A-Njoe, Nicolas Ferrao · Kubernetes on Edge Day Europe 2026