[{"data":1,"prerenderedAt":172},["ShallowReactive",2],{"term-s\u002Fsigned-commits":3,"related-s\u002Fsigned-commits":154},{"id":4,"title":5,"acronym":6,"body":7,"category":135,"description":136,"difficulty":137,"extension":138,"letter":139,"meta":140,"navigation":141,"path":142,"related":143,"seo":148,"sitemap":149,"stem":152,"subcategory":6,"__hash__":153},"terms\u002Fterms\u002Fs\u002Fsigned-commits.md","Signed Commits",null,{"type":8,"value":9,"toc":129},"minimark",[10,15,19,23,26,30,118,122,125],[11,12,14],"h2",{"id":13},"eli5-the-vibe-check","ELI5 - The Vibe Check",[16,17,18],"p",{},"Signed commits are git's way of proving a commit actually came from the person whose name is on it, not from someone who cloned your repo and set git config user.name to your name, which anyone can do in about five seconds. You sign each commit with a GPG or SSH key, and platforms like GitHub show a small verified badge next to the ones that check out.",[11,20,22],{"id":21},"real-talk","Real Talk",[16,24,25],{},"Signed commits use GPG or SSH keys to cryptographically sign commit objects via git commit -S, allowing platforms like GitHub and GitLab to verify that a commit was created by the holder of the associated private key, rather than merely attributed to that identity through the freely editable user.name and user.email git config fields. They're increasingly required in supply chain sensitive projects and regulated environments, since unsigned commits offer no protection against author spoofing.",[11,27,29],{"id":28},"show-me-the-code","Show Me The Code",[31,32,37],"pre",{"className":33,"code":34,"language":35,"meta":36,"style":36},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","$ git config --global commit.gpgsign true\n$ git config --global user.signingkey \u003CKEY_ID>\n$ git commit -S -m \"fix: patch known vulnerability in dependency\"\n","bash","",[38,39,40,66,93],"code",{"__ignoreMap":36},[41,42,45,49,53,56,59,62],"span",{"class":43,"line":44},"line",1,[41,46,48],{"class":47},"sBMFI","$",[41,50,52],{"class":51},"sfazB"," git",[41,54,55],{"class":51}," config",[41,57,58],{"class":51}," --global",[41,60,61],{"class":51}," commit.gpgsign",[41,63,65],{"class":64},"sMK4o"," true\n",[41,67,69,71,73,75,77,80,83,86,90],{"class":43,"line":68},2,[41,70,48],{"class":47},[41,72,52],{"class":51},[41,74,55],{"class":51},[41,76,58],{"class":51},[41,78,79],{"class":51}," user.signingkey",[41,81,82],{"class":64}," \u003C",[41,84,85],{"class":51},"KEY_I",[41,87,89],{"class":88},"sTEyZ","D",[41,91,92],{"class":64},">\n",[41,94,96,98,100,103,106,109,112,115],{"class":43,"line":95},3,[41,97,48],{"class":47},[41,99,52],{"class":51},[41,101,102],{"class":51}," commit",[41,104,105],{"class":51}," -S",[41,107,108],{"class":51}," -m",[41,110,111],{"class":64}," \"",[41,113,114],{"class":51},"fix: patch known vulnerability in dependency",[41,116,117],{"class":64},"\"\n",[11,119,121],{"id":120},"when-youll-hear-this","When You'll Hear This",[16,123,124],{},"\"We require signed commits on main now, spoofed authorship was too easy otherwise.\" \u002F \"GitHub shows Verified next to signed commits, unverified next to everything else.\"",[126,127,128],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":36,"searchDepth":68,"depth":68,"links":130},[131,132,133,134],{"id":13,"depth":68,"text":14},{"id":21,"depth":68,"text":22},{"id":28,"depth":68,"text":29},{"id":120,"depth":68,"text":121},"git","Signed commits are git's way of proving a commit actually came from the person whose name is on it, not from someone who cloned your repo and set git confi...","intermediate","md","s",{},true,"\u002Fterms\u002Fs\u002Fsigned-commits",[144,145,146,147],"Code Signing","Supply Chain Security","CI","CODEOWNERS",{"title":5,"description":136},{"changefreq":150,"priority":151},"weekly",0.7,"terms\u002Fs\u002Fsigned-commits","PCpowSlt8xHTfOZz7-d0xoH0fCS-1VeKrpmyYzywVTw",[155,161,165,168],{"title":146,"path":156,"acronym":157,"category":158,"difficulty":159,"description":160},"\u002Fterms\u002Fc\u002Fci","Continuous Integration","cicd","beginner","CI is like a robot assistant that instantly checks your homework every time you hand it in.",{"title":144,"path":162,"acronym":6,"category":163,"difficulty":137,"description":164},"\u002Fterms\u002Fc\u002Fcode-signing","frontend","Code signing proves that your code is genuinely from you and nobody tampered with it between your computer and the user's device.",{"title":147,"path":166,"acronym":6,"category":135,"difficulty":137,"description":167},"\u002Fterms\u002Fc\u002Fcodeowners","CODEOWNERS is a file that turns who's-supposed-to-review-this from a Slack message into an automatic assignment.",{"title":145,"path":169,"acronym":6,"category":170,"difficulty":137,"description":171},"\u002Fterms\u002Fs\u002Fsupply-chain-security","security","Supply Chain Security protects the entire path from code to production — dependencies, build systems, registries, everything.",1792528124504]