GPG Signature
A software artifact signature verification mechanism based on public-key cryptography in which the publisher signs with a private key and users verify the trustworthiness of the source and the integrity of the content with the public key, used to defend against supply-chain attacks.
Core Facts
Timeline (last 90 days)
GPG signature verification is an important part of open-source supply chain security; users can confirm the authenticity of the source via git verify-commit or the Verified badge in the GitHub interface.
Signatures only prove who produced the commit, not that the code is secure; they still need to be combined with lock file verification and dependency auditing.
For CI bot accounts such as github-actions[bot], GitHub signs the automatically generated commits using its own hosted GPG key.
All Facts (3)
For CI bot accounts such as github-actions[bot], GitHub signs the automatically generated commits using its own hosted GPG key.
75%UnverifiedGPG signature verification is an important part of open-source supply chain security; users can confirm the authenticity of the source via git verify-commit or the Verified badge in the GitHub interface.
50%UnverifiedSignatures only prove who produced the commit, not that the code is secure; they still need to be combined with lock file verification and dependency auditing.
50%