Verified85% confidenceFactExact time
Git supports cryptographic signing of commits and tags using GPG, and the signature binds the commit content to the signer's private key.
5
Sources
85%
Confidence
Long-term
Relevance
10/20/2026
First Seen
Sources
Related Entities
Related Claims
VerifiedBoth SSH keys and GPG keys can be used to sign GitHub commits; GitHub binds public keys to accounts to associate code changes with contributor identities.78% similarVerifiedAfter GPG signature verification passes, GitHub displays a green "Verified" badge, proving the commit originated from the account holding the corresponding private key77% similarUnverifiedWhen verifying a commit signature, GitHub compares the signature in the commit with the public key bound to the committer's account, and only shows Verified if the two match; this mechanism guarantees that the commit comes from that account, not that the code content is correct.77% similarVerifiedFor CI bot accounts such as github-actions[bot], GitHub signs the automatically generated commits using its own hosted GPG key.75% similarVerifiedGitHub automatically attaches a verified signature to commits created through its web interface or specific integrations, and displays a 'Verified' badge in the interface.74% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1074340API
curl https://kongchang.com/api/v1/knowledge/claims/1074340MCP
get_claim(id=1074340)