Claimed or Attested? A Commit-Signature Dataset and Identity Trust Tiers across the World of Code

• URL: http://arxiv.org/abs/2607.06194v1
• Date: Tue, 07 Jul 2026 12:19:25 GMT
• Title: Claimed or Attested? A Commit-Signature Dataset and Identity Trust Tiers across the World of Code
• Abstract summary: We release the first commit-signature axis for the World of Code (WoC)<n>Over the V2604 corpus of 5,866,595,698 commits, 17.59% carry a signature.<n>All artifacts are released as a self-contained, in dependently hosted replication package keyed to the WoC V2604 collection.
• Score: 2.788646205877688
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: An author string in a git commit is free text the committer typed, so identity resolution over a global commit corpus rests on a claim that nothing in the commit verifies. A cryptographically signed commit is different: it binds the commit to a key the committer controls, and when that key ties back to a real-world identity the git identity becomes attested rather than merely claimed. We release the first commit-signature axis for the World of Code (WoC), extracted for the V2604 collection. The signature travels in the commit object's gpgsig header and is already carried, unparsed, in the commit-message field of the WoC commit tables, so the axis is a scan over existing tables rather than a re-read of the object database. Over the V2604 corpus of 5,866,595,698 commits, 17.59% carry a signature (PGP dominant at 98.96%, with a growing minority of SSH and X.509/sigstore signatures), or 1,031,721,316 signed commits. We release the per-commit signature map c2sigFull, a key-to-author graph gated so that shared organization and continuous-integration keys are separated from person keys, and A2trust, a per-identity attestation tier (unsigned, signed, real-world-bound, cross-corpus attested) that extends the published A2cls identity-class dataset. The signature axis is a precision anchor, not a coverage layer: signed commits skew toward recent and security-conscious developers, a population that overlaps the scholarly authors a bibliography join targets. We use the person keys to build a cryptographically grounded alias gold that calibrates the heuristic WoC alias map independently of hand-labeled pairs, and to attach an attestation provenance to science-to-software identity links. All artifacts are released as a self-contained, in dependently hosted replication package keyed to the WoC V2604 collection.

Related papers

• Scaling Author Identity Disambiguation to the World of Code: A Methodology [2.788646205877688]
  We describe the methodology used to alias the World of Code (WoC) collection (version V2604, 107M distinct author strings over 6B commits) into canonical persons.<n>At this scale the central problem is over-merge, not missed merges.<n>We report the full experimental record (more than twenty experiments, including unsuccessful ones) behind the deployed design.
  arXiv  Detail & Related papers  (2026-07-08T02:30:26Z)
• A Global Author-Identity Map for the World of Code:62.7M Developer Identities from 106.8M Author Strings over 5.87B Commits [2.788646205877688]
  We release a curated author-identity map for World of Code (WoC) version V2604 covering all 5,866,595,698 commits.<n>The map is mega-cluster free, its largest cluster 6,910 ids (one GitHub noreply identity), and it resolves 73.5% of six billion commits into multi-id identities.<n>We report both error families, splitting and clumping, and show the high precision claimed by global-scale union maps can be an artifact of never measuring the conflated region.
  arXiv  Detail & Related papers  (2026-07-07T12:09:45Z)
• Git Hash Chain Malleability [0.7106986689736826]
  Git commit signing is widely entrusted to serve as evidence that a commit hash uniquely and immutably identifies a specific piece of signed content.<n>We show this in-variant does not hold. Given any signed commit, an attacker without access to the signing key, and without breaking SHA2 can produce a second, distinct commit with an identical tree, identical metadata, a valid signature, and a Verified'' badge from a Git Forge such as Github.
  arXiv  Detail & Related papers  (2026-07-02T23:19:37Z)
• Analysis of Commit Signing on Github [2.1045887299238855]
  We studied 71,694 active GitHub users, defined as accounts that have authored at least one commit, across all their repositories and their entire commit history, spanning 16 million commits and 874,198 repositories.<n>Fewer than 6% of developers have ever signed a commit themselves, and the vast majority of apparent signers have never signed outside a web browser.<n>Among the minority who do sign locally, signing rarely persists over time or across repositories, and roughly one in eight developer-managed signatures fails verification because signing keys are never uploaded to GitHub.
  arXiv  Detail & Related papers  (2026-04-15T15:57:07Z)
• AgentPack: A Dataset of Code Changes, Co-Authored by Agents and Humans [46.56091965723774]
  Fine-tuning large language models for code editing has typically relied on mining commits and pull requests.<n>We present AgentPack, a corpus of 1.3M code edits co-authored by Claude Code, OpenAI Codex, and Cursor Agent.<n>We show that models fine-tuned on AgentPack can outperform models trained on prior human-only commit corpora.
  arXiv  Detail & Related papers  (2025-09-26T05:28:22Z)
• Decompiling Smart Contracts with a Large Language Model [51.49197239479266]
  Despite Etherscan's 78,047,845 smart contracts deployed on (as of May 26, 2025), a mere 767,520 ( 1%) are open source.<n>This opacity necessitates the automated semantic analysis of on-chain smart contract bytecode.<n>We introduce a pioneering decompilation pipeline that transforms bytecode into human-readable and semantically faithful Solidity code.
  arXiv  Detail & Related papers  (2025-06-24T13:42:59Z)
• On the Prevalence and Usage of Commit Signing on GitHub: A Longitudinal and Cross-Domain Study [1.834753484317836]
  We study the presence of verified commits in GitHub repositories over five years.<n>Only 10% of all the commits in these 60 repositories are verified.<n>We propose ways to identify commit ownership based on GitHub's Events API.
  arXiv  Detail & Related papers  (2025-04-27T12:39:50Z)
• DiVerify: Hardening Identity-Based Software Signing with Programmable Diverse-Context Scopes [11.521573335215239]
  State-of-the-art identity-based code signing schemes have a major shortcoming.<n>They fail to provide verifiable information about the context in which a signature is generated.<n>We propose a diverse identity verification approach that reduces reliance on a single source of verification.
  arXiv  Detail & Related papers  (2024-06-21T18:53:52Z)
• Revocable Quantum Digital Signatures [57.25067425963082]
  We define and construct digital signatures with revocable signing keys from the LWE assumption. In this primitive, the signing key is a quantum state which enables a user to sign many messages. Once the key is successfully revoked, we require that the initial recipient of the key loses the ability to sign.
  arXiv  Detail & Related papers  (2023-12-21T04:10:07Z)
• FedSOV: Federated Model Secure Ownership Verification with Unforgeable Signature [60.99054146321459]
  Federated learning allows multiple parties to collaborate in learning a global model without revealing private data. We propose a cryptographic signature-based federated learning model ownership verification scheme named FedSOV.
  arXiv  Detail & Related papers  (2023-05-10T12:10:02Z)
• Precise Zero-Shot Dense Retrieval without Relevance Labels [60.457378374671656]
  Hypothetical Document Embeddings(HyDE) is a zero-shot dense retrieval system. We show that HyDE significantly outperforms the state-of-the-art unsupervised dense retriever Contriever.
  arXiv  Detail & Related papers  (2022-12-20T18:09:52Z)
• Autoregressive Entity Retrieval [55.38027440347138]
  Entities are at the center of how we represent and aggregate knowledge. The ability to retrieve such entities given a query is fundamental for knowledge-intensive tasks such as entity linking and open-domain question answering. We propose GENRE, the first system that retrieves entities by generating their unique names, left to right, token-by-token in an autoregressive fashion.
  arXiv  Detail & Related papers  (2020-10-02T10:13:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.