Git Commit Signing

[chaksaray]

How to prove that you are the committer? How to ensure that the code is from trusted sources?

Commit signing is the solution to this, as it;

• Accept Only Verify Commit
• Auto Reject Unverified Commit

Furthermore, commit signing will reduce the risk of:

• Supply Chain Attack​
• Application Compromise/Backdoor​
• Compliance / Regulatory Issue​
• Reputation Damage​
• Break Code Integrity