Unverified50% confidenceFactExact time
The GitHub REST API endpoint GET /repos/{owner}/{repo}/git/tags/{tag_sha} can return tag object details, and the response for a signed tag includes a verification field, where verified being true indicates the signature is valid.
1
Sources
50%
Confidence
Long-term
Relevance
10/20/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedGitHub automatically attaches a verified signature to commits created through its web interface or specific integrations, and displays a 'Verified' badge in the interface.72% similarUnverifiedWhen verifying a commit signature, GitHub compares the signature in the commit with the public key bound to the committer's account, and only shows Verified if the two match; this mechanism guarantees that the commit comes from that account, not that the code content is correct.71% similarUnverifiedSemantic version tags and Git branch names are both mutable pointers that the repository owner or a compromised account can redirect to a different commit at any time.71% similarUnverifiedGit supports cryptographic signing of commits and tags using GPG, and the signature binds the commit content to the signer's private key.69% similarUnverifiedGitHub、GitLab、AWS等平台在启用MFA的流程中会强制用户确认已保存恢复码69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1076343API
curl https://kongchang.com/api/v1/knowledge/claims/1076343MCP
get_claim(id=1076343)