Analysis of Commit Signing on Github
Abubakar Sadiq Shittu, John Sadik, Farzin Gholamrezae, Scott Ruoti
TLDR
GitHub commit signing is largely ineffective for supply chain security due to low developer adoption and poor key management practices.
Key contributions
- Less than 6% of GitHub developers sign commits themselves, excluding platform-generated signatures.
- Most apparent signing is done via web browsers or platform automation, not local developer tools.
- Developer-managed signatures often fail verification because signing keys are not uploaded to GitHub.
- Key management is poor; expired keys are rarely revoked, and many users have dead keys.
Why it matters
This study reveals that GitHub's commit signing, despite its promotion for supply chain security, is largely ineffective due to low developer adoption and poor key management. It exposes a critical gap in current security practices, showing that apparent high adoption is an illusion. The findings provide concrete recommendations to improve the reliability of commit signing as a provenance signal.
Original Abstract
Commit signing is widely promoted as a foundation of software supply-chain security, yet prior work has studied it through the lens of individual repositories or curated project samples, missing the broader picture of how developers behave across an entire platform. Grounded in replicability theory, we vary the sampling unit from repositories to individual developers, following 71,694 active GitHub users, defined as accounts that have authored at least one commit, across all their repositories and their entire commit history, spanning 16 million commits and 874,198 repositories. This platform-wide, user-centric view reveals a fundamental gap that repository sampling cannot detect. The ecosystem's apparent high signing adoption rate is an illusion. Once platform-generated signatures are excluded, fewer than 6% of developers have ever signed a commit themselves, and the vast majority of apparent signers have never signed outside a web browser. Among the minority who do sign locally, signing rarely persists over time or across repositories, and roughly one in eight developer-managed signatures fails verification because signing keys are never uploaded to GitHub. Examining the key registry, we find that expired keys are almost never revoked and more than a quarter of users carry at least one dead key. Together, these findings reveal that commit signing as practiced today cannot serve as a dependable provenance signal at ecosystem scale, and we offer concrete recommendations for closing that gap.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.