I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata?
How could I manually duplicate the signature, use gpg instead of git?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
I took a look at the function "commit_tree_extended" in the git source code for the file "commit.c" (e.g., in this blob).
Based on reviewing this function, when you sign a commit it seems to be signing a string that contains identifiers for the tree object_id, parent object_id, author, committer, encoding (if not utf-8), commit_extra_header, and the commit message.