108

So someone peer reviewed my work, and he told me that I should always sign my commits and tags cryptographically. When asked why, he didn't know to explain it to me, and said "It's just a good thing to do".

Trying to avoid an obvious chimpanzee scenario, why should I really? Are there really so many distinct advantages and no disadvantages?

What are the practical reasons which would make me want to sign every commit and tag I make?

  • 3
    I assume it's so that there's a paper-trail tying the commit to you. I've never signed a commit before though, either with git or any other source control system. If your peer believes there's a risk of fraudulent commits your company probably has bigger security problems. – James Sep 22 '13 at 10:28
  • @James: It's not company work, but I do participate in some open and closed source projects. – Madara Uchiha Sep 22 '13 at 10:29
  • @James: "bigger security problems" --- like what? Signing is a technical way of solving them isn't it? – zerkms Sep 22 '13 at 10:29
  • 8
    mikegerwitz.com/papers/git-horror-story.html is a starting point for the use case of signed commits and tags. – user40980 Sep 22 '13 at 12:53
  • 1
    @James when you commit using your SVN account, you sign your commit. When you commit with your git global config, you are the only authority confirming that you are the author. – Florian Margaine Sep 22 '13 at 20:19
101

(This is largely based on A Git Horror Story: Repository Integrity With Signed Commits—a very good read, and more information than I could put into an answer.)

There are a number of ways in which a git repository can be compromised (this isn't a security flaw, just a fact of life—one should not avoid using git because of this). For example, someone may have pushed to your repository claiming to be you. Or for that matter, someone could have pushed to someone else's repository claiming to be you (someone could push to their own repository claiming to be you too). This is just part of life in a DVCS.

Just as an example:

$ git config --global user.name 'Madara Uchiha'
$ git config --global user.email muchiha@example.com

There, I've changed my git configuration to pretend I'm you. And now I can commit away and let those commits somehow make their way into the production build, and it looks like you've done it.

With signing of the commits (and tags), one can prove that certain commits and tags were from you (and things that aren't signed shouldn't have made it into the production build). That's really the key to it all—by signing commits you've said it's your work.

The "your work" aspect is particularly important in the linux kernel (and thus git) that is occasionally hit with copyright lawsuits. By signing commits you say that you have the right to the software—it tracks the origin. It may be that you've got no access to the source that is being claimed as copyright and the claim is groundless. It may be that the company forgot that you were working for them a few years ago and under their direction added material to the kernel, or whatever.

There is some debate as to if every commit should be signed. From GPG signing for git commit? (back in '09), Linus wrote:

Signing each commit is totally stupid. It just means that you automate it, and you make the signature worth less. It also doesn't add any real value, since the way the git DAG-chain of SHA1's work, you only ever need one signature to make all the commits reachable from that one be effectively covered by that one. So signing each commit is simply missing the point.

Much more about the thoughts on signing in git can be read there too.

That said, it made its way into git anyways.

There seems to be a majority consensus that signing commits is unnecessary, but signing tags is very good. That blog post linked at the top suggests that one should sign everything anyways. As I said, there's some debate about if every commit is necessary or not.

The key to the "sign every commit" debate probably has to do with the workflow you use. Most people make a bunch of commits in their local repo, and then push that set. It should be sufficient to tag the final collection (assuming, that is, you make sure that all the changes are correct). If you are working in an environment where lots of single commits are moving around, the distinction between a tag and a commit becomes less… distinct—and signing commits may become more useful.

  • 5
    It may be sufficient (to just tag the last one), but why wouldn't you just tag every commit? – hayd Apr 29 '16 at 22:12
  • 3
    As a lazy bastard who doesn't use tags, I'm updooting the previous comment. In the git config on my workstation I have commit.gpgsign = true and I can ascertain no disadvantages. While it might be silly, it doesn't seem to be too expensive. – pnovotnak Oct 12 '16 at 20:52
  • 3
    I'm going with @pnovotnak on this one, why wouldn't you do this? I mean i I sign my commits and another developer doesn't on the same project, who cares? But if a hacker tries to steal my identity I can just point out the signing. Seems to me that signing only has advantages. I do agree that your signature gets less value, but you trade this for not having to think about it. Its basically free security. – Jappie Kerk Jan 14 '17 at 14:03
  • 2
    My personal opinion is that signing every commit is a good thing. I can be pretty certain that commits with my signature came from me, whereas it's trivial to impersonate an author with vanilla git. I would rather call it free validation it's the person you otherwise assume it to be, not security. – berto Sep 7 '17 at 14:08
  • 1
    @JosiahYoder. No, Github won't refuse a push because the email is not on their service. Let's say you were hosting your code on another service (ie: Bitbucket) and you wanted to move your repository to another provider. It would prevent users from transferring a repository (Multiple commits by multiple users) or creating mirrors, etc. It is a feature of DVCS. – Ricky Notaro-Garcia Oct 22 '18 at 16:24

protected by gnat Jun 16 '18 at 8:32

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.