Git Cryptographic Signature Formats

gitformat-signature(5) ====================== NAME ---- gitformat-signature - Git cryptographic signature formats SYNOPSIS -------- [verse] <[tag|commit] object header(s)> <over-the-wire protocol> DESCRIPTION ----------- Git uses cryptographic signatures in various places, currently objects (tags, commits, mergetags) and transactions (pushes). In every case, the command which is about to create an object or transaction determines a payload from that, calls an external program to obtain a detached signature for the payload (`gpg -bsa` in the case of PGP signatures), and embeds the signature into the object or transaction. Signatures begin with an "ASCII Armor" header line and end with a tail line, which differ depending on signature type (as selected by `gpg.format`, see linkgit:git-config[1]). These are, for `gpg.format` values: `gpg` (PGP):: `-----BEGIN PGP SIGNATURE-----` and `-----END PGP SIGNATURE-----`. Or, if gpg is told to produce RFC1991 signatures, `-----BEGIN PGP MESSAGE-----` and `-----END PGP MESSAGE-----` `ssh` (SSH):: `-----BEGIN SSH SIGNATURE-----` and `-----END SSH SIGNATURE-----` `x509` (X.509):: `-----BEGIN SIGNED MESSAGE-----` and `-----END SIGNED MESSAGE-----` Signatures sometimes appear as a part of the normal payload (e.g. a signed tag has the signature block appended after the payload that the signature applies to), and sometimes appear in the value of an object header (e.g. a merge commit that merged a signed tag would have the entire tag contents on its "mergetag" header). In the case of the latter, the usual multi-line formatting rule for object headers applies. I.e. the second and subsequent lines are prefixed with a SP to signal that the line is continued from the previous line. This is even true for an originally empty line. In the following examples, the end of line that ends with a whitespace letter is highlighted with a `$` sign; if you are trying to recreate these example by hand, do not cut and paste them--they are there primarily to highlight extra whitespace at the end of some lines. The signed payload and the way the signature is embedded depends on the type of the object resp. transaction. == Tag signatures - created by: `git tag -s` - payload: annotated tag object - embedding: append the signature to the unsigned tag object - example: tag `signedtag` with subject `signed tag` ---- object 04b871796dc0420f8e7561a895b52484b701d51a type commit tag signedtag tagger C O Mitter <committer@example.com> 1465981006 +0000 signed tag signed tag message body -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAABAgAGBQJXYRhOAAoJEGEJLoW3InGJklkIAIcnhL7RwEb/+QeX9enkXhxn rxfdqrvWd1K80sl2TOt8Bg/NYwrUBw/RWJ+sg/hhHp4WtvE1HDGHlkEz3y11Lkuh 8tSxS3qKTxXUGozyPGuE90sJfExhZlW4knIQ1wt/yWqM+33E9pN4hzPqLwyrdods q8FWEqPPUbSJXoMbRPw04S5jrLtZSsUWbRYjmJCHzlhSfFWW4eFd37uquIaLUBS0 rkC3Jrx7420jkIpgFcTI2s60uhSQLzgcCwdA2ukSYIRnjg/zDkj8+3h/GaROJ72x lZyI6HWixKJkWw8lE9aAOD9TmTW9sFJwcVAzmAuFX2kUreDUKMZduGcoRYGpD7E= =jpXa -----END PGP SIGNATURE----- ---- - verify with: `git verify-tag [-v]` or `git tag -v` ---- gpg: Signature made Wed Jun 15 10:56:46 2016 CEST using RSA key ID B7227189 gpg: Good signature from "Eris Discordia <discord@example.net>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189 object 04b871796dc0420f8e7561a895b52484b701d51a type commit tag signedtag tagger C O Mitter <committer@example.com> 1465981006 +0000 signed tag signed tag message body ---- == Commit signatures - created by: `git commit -S` - payload: commit object - embedding: header entry `gpgsig` (content is preceded by a space) - example: commit with subject `signed commit` ---- tree eebfed94e75e7760540d1485c740902590a00332 parent 04b871796dc0420f8e7561a895b52484b701d51a author A U Thor <author@example.com> 1465981137 +0000 committer C O Mitter <committer@example.com>

Git uses cryptographic signatures for objects and transactions, with different formats for PGP, SSH, and X.509 signatures, which are embedded in the object or transaction, and can be verified using Git commands.