On the Prevalence and Usage of Commit Signing on GitHub: A Longitudinal and Cross-Domain Study

• URL: http://arxiv.org/abs/2504.19215v1
• Date: Sun, 27 Apr 2025 12:39:50 GMT
• Title: On the Prevalence and Usage of Commit Signing on GitHub: A Longitudinal and Cross-Domain Study
• Abstract summary: We study the presence of verified commits in GitHub repositories over five years.<n>Only 10% of all the commits in these 60 repositories are verified.<n>We propose ways to identify commit ownership based on GitHub's Events API.
• Score: 1.834753484317836
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: GitHub is one of the most widely used public code development platform. However, the code hosted publicly on the platform is vulnerable to commit spoofing that allows an adversary to introduce malicious code or commits into the repository by spoofing the commit metadata to indicate that the code was added by a legitimate user. The only defense that GitHub employs is the process of commit signing, which indicates whether a commit is from a valid source or not based on the keys registered by the users. In this work, we perform an empirical analysis of how prevalent is the use of commit signing in commonly used GitHub repositories. To this end, we build a framework that allows us to extract the metadata of all prior commits of a GitHub repository, and identify what commits in the repository are verified. We analyzed 60 open-source repositories belonging to four different domains -- web development, databases, machine learning and security -- using our framework and study the presence of verified commits in each repositories over five years. Our analysis shows that only ~10% of all the commits in these 60 repositories are verified. Developers committing code to security-related repositories are much more vigilant when it comes to signing commits by users. We also analyzed different Git clients for the ease of commit signing, and found that GitKraken provides the most convenient way of commit signing whereas GitHub Web provides the most accessible way for verifying commits. During our analysis, we also identified an unexpected behavior in how GitHub handles unverified emails in user accounts preventing legitimate owner to use the email address. We believe that the low number of verified commits may be due to lack of awareness, difficulty in setup and key management. Finally, we propose ways to identify commit ownership based on GitHub's Events API addressing the issue of commit spoofing.

Related papers

• A Multi-Month Study of Git Commit Signing [2.2991119948183534]
  Git commit signing, introduced in 2012, is one mechanism for establishing commit provenance in software supply chains.<n>We conducted a three-month study with senior undergraduate and graduate computer science students.<n>Nearly half expressed at least one misconception regarding signing guarantees or key management.
  arXiv  Detail & Related papers  (2026-08-29T14:07:00Z)
• Git Hash Chain Malleability [0.7106986689736826]
  Git commit signing is widely entrusted to serve as evidence that a commit hash uniquely and immutably identifies a specific piece of signed content.<n>We show this in-variant does not hold. Given any signed commit, an attacker without access to the signing key, and without breaking SHA2 can produce a second, distinct commit with an identical tree, identical metadata, a valid signature, and a Verified'' badge from a Git Forge such as Github.
  arXiv  Detail & Related papers  (2026-07-02T23:19:37Z)
• On the GitHub Actions Language: Usage, Evolution, and Workflow Reliability [44.257027748554606]
  This paper empirically explores how the adoption and evolution of GitHub Actions language constructs impacts workflow reliability and maintainability.<n>We quantitatively analyse 260K from 49K GitHub repositories to understand how they are used in practice and how their usage has evolved from July 2019 to August 2025.
  arXiv  Detail & Related papers  (2026-05-26T10:43:14Z)
• What's Inside a GitHub Repository? An Empirical Study on the Contents of 10K Projects [1.439946676159516]
  This paper presents an initial empirical analysis to better understand the contents of real-world GitHub.<n>We analyze the files, directories, and extensions present in 10,000 GitHub repositories, as well as their evolution over ten years.
  arXiv  Detail & Related papers  (2026-05-15T23:30:44Z)
• Analysis of Commit Signing on Github [2.1045887299238855]
  We studied 71,694 active GitHub users, defined as accounts that have authored at least one commit, across all their repositories and their entire commit history, spanning 16 million commits and 874,198 repositories.<n>Fewer than 6% of developers have ever signed a commit themselves, and the vast majority of apparent signers have never signed outside a web browser.<n>Among the minority who do sign locally, signing rarely persists over time or across repositories, and roughly one in eight developer-managed signatures fails verification because signing keys are never uploaded to GitHub.
  arXiv  Detail & Related papers  (2026-04-15T15:57:07Z)
• Trace: Securing Smart Contract Repository Against Access Control Vulnerability [58.02691083789239]
  GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files.<n>Third-party developers often reference, reuse, or fork code from these repositories during custom development.<n>Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories.
  arXiv  Detail & Related papers  (2025-10-22T05:18:28Z)
• AgentPack: A Dataset of Code Changes, Co-Authored by Agents and Humans [46.56091965723774]
  Fine-tuning large language models for code editing has typically relied on mining commits and pull requests.<n>We present AgentPack, a corpus of 1.3M code edits co-authored by Claude Code, OpenAI Codex, and Cursor Agent.<n>We show that models fine-tuned on AgentPack can outperform models trained on prior human-only commit corpora.
  arXiv  Detail & Related papers  (2025-09-26T05:28:22Z)
• Classifying Issues in Open-source GitHub Repositories [0.0]
  GitHub is the most widely used platform for software maintenance in the open-source community.<n>Developers report issues on GitHub from time to time while facing difficulties.<n>Most of the GitHub repositories do not maintain regular labeling for the issues.
  arXiv  Detail & Related papers  (2025-07-25T06:20:54Z)
• SwingArena: Competitive Programming Arena for Long-context GitHub Issue Solving [90.32201622392137]
  We present SwingArena, a competitive evaluation framework for Large Language Models (LLMs)<n>Unlike traditional static benchmarks, SwingArena models the collaborative process of software by pairing LLMs as iterations, who generate patches, and reviewers, who create test cases and verify the patches through continuous integration (CI) pipelines.
  arXiv  Detail & Related papers  (2025-05-29T18:28:02Z)
• MutaGReP: Execution-Free Repository-Grounded Plan Search for Code-Use [92.28400093066212]
  MutaGReP is an approach to search for plans that decompose a user request into natural language steps grounded in a large code repository.<n>Our plans use less than 5% of the 128K context window for GPT-4o but rival the coding performance of GPT-4o with a context window filled with the repo.
  arXiv  Detail & Related papers  (2025-02-21T18:58:17Z)
• An Empirical Study of Dotfiles Repositories Containing User-Specific Configuration Files [1.7556600627464058]
  Hundreds of thousands choose to publicly host their repositories on GitHub.<n>We collected and analyzed publicly-hosted dotfiles repositories on GitHub.<n>We found that 25.8% of the top 500 most-starred GitHub users maintain some form of publicly accessible dotfiles repository.
  arXiv  Detail & Related papers  (2025-01-30T18:32:46Z)
• 4.5 Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Scams, and Malware [58.60545935390151]
  We present a global, longitudinal measurement study of fake stars in GitHub.<n>We build StarScout, a scalable tool able to detect anomalous starring behaviors.<n>Our study has implications for platform moderators, open-source practitioners, and supply chain security researchers.
  arXiv  Detail & Related papers  (2024-12-18T03:03:58Z)
• Visual Analysis of GitHub Issues to Gain Insights [2.9051263101214566]
  This paper presents a prototype web application that generates visualizations to offer insights into issue timelines. It focuses on the lifecycle of issues and depicts vital information to enhance users' understanding of development patterns.
  arXiv  Detail & Related papers  (2024-07-30T15:17:57Z)
• Alibaba LingmaAgent: Improving Automated Issue Resolution via Comprehensive Repository Exploration [64.19431011897515]
  This paper presents Alibaba LingmaAgent, a novel Automated Software Engineering method designed to comprehensively understand and utilize whole software repositories for issue resolution.<n>Our approach introduces a top-down method to condense critical repository information into a knowledge graph, reducing complexity, and employs a Monte Carlo tree search based strategy.<n>In production deployment and evaluation at Alibaba Cloud, LingmaAgent automatically resolved 16.9% of in-house issues faced by development engineers, and solved 43.3% of problems after manual intervention.
  arXiv  Detail & Related papers  (2024-06-03T15:20:06Z)
• MAGIS: LLM-Based Multi-Agent Framework for GitHub Issue Resolution [47.850418420195304]
  Large Language Models (LLMs) have shown promise in code generation but face difficulties in resolving GitHub issues. We propose a novel Multi-Agent framework for GitHub Issue reSolution, MAGIS, consisting of four agents customized for software evolution.
  arXiv  Detail & Related papers  (2024-03-26T17:57:57Z)
• Unveiling A Hidden Risk: Exposing Educational but Malicious Repositories in GitHub [0.0]
  We use ChatGPT to understand and annotate the content published in software repositories. We carry out a systematic study on a collection of 35.2K GitHub repositories claimed to be created for educational purposes only.
  arXiv  Detail & Related papers  (2024-03-07T11:36:09Z)
• GitAgent: Facilitating Autonomous Agent with GitHub by Tool Extension [81.44231422624055]
  A growing area of research focuses on Large Language Models (LLMs) equipped with external tools capable of performing diverse tasks. In this paper, we introduce GitAgent, an agent capable of achieving the autonomous tool extension from GitHub.
  arXiv  Detail & Related papers  (2023-12-28T15:47:30Z)
• Wait, wasn't that code here before? Detecting Outdated Software Documentation [9.45052138795667]
  We present a GitHub Actions tool that automatically scans for outdated code element references. More than a quarter of the 1000 most popular projects on GitHub contained at least one outdated reference.
  arXiv  Detail & Related papers  (2023-07-10T00:52:29Z)
• On the Security Blind Spots of Software Composition Analysis [46.1389163921338]
  We present a novel approach to detect vulnerable clones in the Maven repository. We retrieve over 53k potential vulnerable clones from Maven Central. We detect 727 confirmed vulnerable clones and synthesize a testable proof-of-vulnerability project for each of those.
  arXiv  Detail & Related papers  (2023-06-08T20:14:46Z)
• GitHub Actions: The Impact on the Pull Request Process [7.047566396769727]
  This study investigates how projects use GitHub Actions, what the developers discuss about them, and how project activity indicators change after their adoption. Our results indicate that 1,489 out of 5,000 most popular repositories (almost 30% of our sample) adopt GitHub Actions. Our findings also suggest that the adoption of GitHub Actions leads to more rejections of pull requests (PRs), more communication in accepted PRs and less communication in rejected PRs.
  arXiv  Detail & Related papers  (2022-06-28T16:24:17Z)
• A ground-truth dataset and classification model for detecting bots in GitHub issue and PR comments [70.1864008701113]
  Bots are used in Github repositories to automate repetitive activities that are part of the distributed software development process. This paper proposes a ground-truth dataset, based on a manual analysis with high interrater agreement, of pull request and issue comments in 5,000 distinct Github accounts. We propose an automated classification model to detect bots, taking as main features the number of empty and non-empty comments of each account, the number of comment patterns, and the inequality between comments within comment patterns.
  arXiv  Detail & Related papers  (2020-10-07T09:30:52Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.