Verified75% confidenceFactExact time
After GPG signature verification passes, GitHub displays a green "Verified" badge, proving the commit originated from the account holding the corresponding private key
3
Sources
75%
Confidence
Long-term
Relevance
10/4/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedGitHub began displaying Verified badges in its interface and supporting SSH key signing in 2022; prior to this, only GPG was supported.71% similarUnverifiedBoth SSH keys and GPG keys can be used to sign GitHub commits; GitHub binds public keys to accounts to associate code changes with contributor identities.71% similarUnverifiedGitHub automatically attaches a verified signature to commits created through its web interface or specific integrations, and displays a 'Verified' badge in the interface.70% similarUnverifiedFor CI bot accounts such as github-actions[bot], GitHub signs the automatically generated commits using its own hosted GPG key.69% similarUnverifiedGitHub attestation allows users to verify, through commands such as gh attestation verify, that a certain npm package was indeed built from the specified repository and commit.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/971285API
curl https://kongchang.com/api/v1/knowledge/claims/971285MCP
get_claim(id=971285)