2

I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata?

How could I manually duplicate the signature, use gpg instead of git?

Improve this question
1

1 Answer 1

Reset to default
5

I took a look at the function "commit_tree_extended" in the git source code for the file "commit.c" (e.g., in this blob).

Based on reviewing this function, when you sign a commit it seems to be signing a string that contains identifiers for the tree object_id, parent object_id, author, committer, encoding (if not utf-8), commit_extra_header, and the commit message.

Improve this answer
2
  • 1
    Excellent, so commit message and metadata was on the right track. Thank you for the precision. :-)
    – flickerfly
    Jan 15, 2021 at 14:15
  • 1
    The joys of open source :)
    – hft
    Jan 15, 2021 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .