GPG
A cryptographic tool based on the OpenPGP standard, used to generate and verify digital signatures, ensuring the authenticity and integrity of commits and release artifacts in open-source projects.
Core Facts
v0.40.5 was automatically released by GitHub Actions with a GPG-verified signature.
GPG signing is a digital signature mechanism based on public-key cryptography, used for integrity verification in software releases and capable of defending against supply chain attacks.
GPG signing is a digital signature mechanism based on asymmetric encryption; in GitHub's release workflow, maintainers use a private key to sign release artifacts, and users can verify the signature's validity using a public key.
Timeline (last 90 days)
The GPG key ID B5690EEEBB952194 is a short identifier for the signer's public key, which can be used to retrieve the full public key on a key server and verify the signer's identity.
GPG commit signing only guarantees the origin and integrity of a commit, and is not equivalent to a security audit of the code content.
The GitHub verification signature on a commit comes from a GPG key, allowing other users to confirm that the commit indeed came from that account and that the content has not been tampered with.
In the npm ecosystem, GPG signatures are often combined with provenance attestation to prove that a package version was built by a designated CI pipeline from a specific repository and commit, reducing the risk of dependencies being replaced or poisoned.
The Verified badge on GitHub comes from GPG signature verification; when verification fails or is missing, it is marked as Unverified.
A GPG key ID is usually the last 16 hexadecimal characters of the public key fingerprint.
B5690EEEBB952194 is the short format of a GPG key ID, namely the last 16 hexadecimal characters of the key fingerprint.
Signature verification only guarantees that a certain commit was signed by a certain key; if the private key leaks or the account is compromised, it can still be impersonated, so it is one link in supply chain security rather than the whole.
Combining CI automated publishing and GPG signing enables provenance traceability across the entire chain from code commit to npm package publication, reducing the risk of dependency poisoning.
GPG (GNU Privacy Guard) is an asymmetric encryption tool with which developers can generate a pair of public and private keys; after signing a Git commit or release tag with the private key, anyone holding the corresponding public key can verify that the commit was indeed created by the holder of the private key and that its content has not been tampered with.
33 more timeline events
All Facts (20)
v0.40.5 was automatically released by GitHub Actions with a GPG-verified signature.
90%VerifiedGPG signing is a digital signature mechanism based on public-key cryptography, used for integrity verification in software releases and capable of defending against supply chain attacks.
90%VerifiedGPG signing is a digital signature mechanism based on asymmetric encryption; in GitHub's release workflow, maintainers use a private key to sign release artifacts, and users can verify the signature's validity using a public key.
90%VerifiedGit supports cryptographic signing of commits and tags using GPG, and the signature binds the commit content to the signer's private key.
85%VerifiedVercel uses an automated release process in which releases are automatically triggered by github-actions, and commits are verified with GPG signatures.
80%VerifiedGitHub automatically attaches a verified signature to commits created through its web interface or specific integrations, and displays a 'Verified' badge in the interface.
80%VerifiedThe GitHub verification signature on a commit comes from a GPG key, allowing other users to confirm that the commit indeed came from that account and that the content has not been tampered with.
75%VerifiedAfter GPG signature verification passes, GitHub displays a green "Verified" badge, proving the commit originated from the account holding the corresponding private key
75%VerifiedGitHub trusted signing (Sigstore/GitHub Attestations) verifies the provenance of release artifacts through cryptographic endorsement, serving as a means of strengthening npm supply chain security.
75%VerifiedGPG signature verification is a standard method used in open-source software release processes to confirm the authenticity of artifacts, and can effectively guard against supply chain attacks.
75%VerifiedGPG is an encryption tool based on the OpenPGP standard; developers sign release artifacts with a private key, and users verify them with a public key to confirm the content has not been tampered with.
75%VerifiedPhil Zimmermann released PGP (Pretty Good Privacy) in 1991, providing end-to-end encryption capabilities for email, which later evolved into the open-source GPG (GNU Privacy Guard) standard.
65%UnverifiedThe commit record for this version shows 6 commits, automatically built by github-actions with GPG signature verification attached.
70%UnverifiedThe GPG key ID B5690EEEBB952194 is a short identifier for the signer's public key, which can be used to retrieve the full public key on a key server and verify the signer's identity.
50%UnverifiedGPG commit signing only guarantees the origin and integrity of a commit, and is not equivalent to a security audit of the code content.
50%UnverifiedIn the npm ecosystem, GPG signatures are often combined with provenance attestation to prove that a package version was built by a designated CI pipeline from a specific repository and commit, reducing the risk of dependencies being replaced or poisoned.
50%UnverifiedThe Verified badge on GitHub comes from GPG signature verification; when verification fails or is missing, it is marked as Unverified.
50%UnverifiedA GPG key ID is usually the last 16 hexadecimal characters of the public key fingerprint.
50%UnverifiedSignature verification only guarantees that a certain commit was signed by a certain key; if the private key leaks or the account is compromised, it can still be impersonated, so it is one link in supply chain security rather than the whole.
50%UnverifiedB5690EEEBB952194 is the short format of a GPG key ID, namely the last 16 hexadecimal characters of the key fingerprint.
50%