Verified75% confidenceFactExact time
The GitHub verification signature on a commit comes from a GPG key, allowing other users to confirm that the commit indeed came from that account and that the content has not been tampered with.
3
Sources
75%
Confidence
Long-term
Relevance
10/24/2026
First Seen
Sources
Related Entities
Related Claims
VerifiedGPG signing is a digital signature mechanism based on asymmetric encryption; in GitHub's release workflow, maintainers use a private key to sign release artifacts, and users can verify the signature's validity using a public key.78% similarUnverifiedIn the npm ecosystem, GPG signature verification cannot prevent account theft, but it lets downstream consumers confirm that artifacts come from the expected build process (such as GitHub Actions), rather than from commits forged locally by an attacker.77% similarVerifiedThe commit is signed with GPG key ID B5690EEEBB952194 and has been verified.71% similarUnverifiedSigning published packages with GPG keys allows users to verify that the version was genuinely produced by a legitimate build process, thereby reducing the risk of dependency poisoning attacks.68% similarVerifiedGitHub's Vigilant Mode flags all commits in a repository that are unsigned or whose signatures cannot be verified, marking them as verified, unverified, or unsigned.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1094163API
curl https://kongchang.com/api/v1/knowledge/claims/1094163MCP
get_claim(id=1094163)