I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata?

How could I manually duplicate the signature, use gpg instead of git?


1 Answer 1


I took a look at the function "commit_tree_extended" in the git source code for the file "commit.c" (e.g., in this blob).

Based on reviewing this function, when you sign a commit it seems to be signing a string that contains identifiers for the tree object_id, parent object_id, author, committer, encoding (if not utf-8), commit_extra_header, and the commit message.

  • 1
    Excellent, so commit message and metadata was on the right track. Thank you for the precision. :-)
    – flickerfly
    Jan 15, 2021 at 14:15
  • 1
    The joys of open source :)
    – hft
    Jan 15, 2021 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.