Analysis of Commit Signing on Github

Abubakar Sadiq Shittu, John Sadik, Farzin Gholamrezae +1

Securing the open-source software supply chain requires verifying the provenance of every code contribution. While end-to-end (E2E) cryptographic commit signing is widely promoted…