A Multi-Month Study of Git Commit Signing

• URL: http://arxiv.org/abs/2608.29283v1
• Date: Sat, 29 Aug 2026 14:07:00 GMT
• Title: A Multi-Month Study of Git Commit Signing
• Abstract summary: Git commit signing, introduced in 2012, is one mechanism for establishing commit provenance in software supply chains.<n>We conducted a three-month study with senior undergraduate and graduate computer science students.<n>Nearly half expressed at least one misconception regarding signing guarantees or key management.
• Score: 2.2991119948183534
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Git commit signing, introduced in 2012, is one mechanism for establishing commit provenance in software supply chains, yet developer-controlled adoption remains rare and developers' experiences using it are understudied. To examine this experience, we conducted a three-month study with senior undergraduate and graduate computer science students (n = 22), whom we treat as proxies for junior developers. Participants configured commit signing independently, used it across four coursework projects, extended it to a second device, examined an external repository containing anomalous commits, and answered security-reasoning prompts. We found that while almost all participants successfully signed every commit and rated routine signing positively, many faced friction during setup, multi-device configuration, and repository verification. Despite signing all semester, they struggled to spot anomalous commits during verification, with over a quarter finding none. Additionally, nearly half expressed at least one misconception regarding signing guarantees or key management. Without isolating whether these difficulties stemmed from tooling, education, or understanding, we conclude that making signing easier is not enough to ensure effective security use. Rather, secure adoption also requires tools and education that support signature verification against authorized identities, interpretation of missing signatures and unknown keys, and correct reasoning about key-lifecycle operations.

Related papers

• Vero: Can AI Agents Build Formally Verified Software Repositories? [45.09790101960906]
  Vero is the first benchmark to evaluate joint implementation and proof at the repository level.<n>It contains 43 multi-module instances from real-world repositories spanning Python, Dafny, Verus, and Coq.<n>To improve benchmark reliability, Vero also includes an audit mechanism where agents are allowed to formally prove unsatisfiability of provided specification.
  arXiv  Detail & Related papers  (2026-08-13T17:41:27Z)
• Analysis of Commit Signing on Github [2.1045887299238855]
  We studied 71,694 active GitHub users, defined as accounts that have authored at least one commit, across all their repositories and their entire commit history, spanning 16 million commits and 874,198 repositories.<n>Fewer than 6% of developers have ever signed a commit themselves, and the vast majority of apparent signers have never signed outside a web browser.<n>Among the minority who do sign locally, signing rarely persists over time or across repositories, and roughly one in eight developer-managed signatures fails verification because signing keys are never uploaded to GitHub.
  arXiv  Detail & Related papers  (2026-04-15T15:57:07Z)
• Effective Strategies for Asynchronous Software Engineering Agents [52.76455094324273]
  We introduce a structured multi-agent coordination paradigm grounded in three core SWE primitives: centralized task delegation, asynchronous execution, and isolated workspaces.<n>We find that CAID improves accuracy over single-agent baselines by 26.7% absolute on paper reproduction tasks (PaperBench) and 14.3% on Python library development tasks (Commit0).
  arXiv  Detail & Related papers  (2026-03-23T02:26:35Z)
• TOM-SWE: User Mental Modeling For Software Engineering Agents [75.28749912645127]
  ToM-SWE is a dual-agent architecture that pairs a primary software-engineering (SWE) agent with a lightweight theory-of-mind (ToM) partner agent.<n>ToM-SWE infers user goals, constraints, and preferences from instructions and interaction history.<n>In two software engineering benchmarks, ToM-SWE improves task success rates and user satisfaction.
  arXiv  Detail & Related papers  (2025-10-24T16:09:51Z)
• Trace: Securing Smart Contract Repository Against Access Control Vulnerability [58.02691083789239]
  GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files.<n>Third-party developers often reference, reuse, or fork code from these repositories during custom development.<n>Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories.
  arXiv  Detail & Related papers  (2025-10-22T05:18:28Z)
• Usability of Token-based and Remote Electronic Signatures: A User Experience Study [0.0]
  This study empirically evaluates and compares two major e-signature systems -- token-based and remote signatures.<n>Remote e-signatures perceived as significantly more usable than token-based ones.<n>More participants preferred remote e-signatures for document signing, but preference did not reach statistical significance.
  arXiv  Detail & Related papers  (2025-05-24T18:21:06Z)
• On the Prevalence and Usage of Commit Signing on GitHub: A Longitudinal and Cross-Domain Study [1.834753484317836]
  We study the presence of verified commits in GitHub repositories over five years.<n>Only 10% of all the commits in these 60 repositories are verified.<n>We propose ways to identify commit ownership based on GitHub's Events API.
  arXiv  Detail & Related papers  (2025-04-27T12:39:50Z)
• Bridging the Gap: A Comparative Study of Academic and Developer Approaches to Smart Contract Vulnerabilities [5.052062767357937]
  We investigate the strategies adopted by Solidity developers to fix security vulnerabilities in smart contracts.<n>From non-aligned commits, we identified 27 novel fixing strategies not previously discussed in the literature.<n>These emerging patterns offer actionable solutions for securing smart contracts in underexplored areas.
  arXiv  Detail & Related papers  (2025-04-16T19:20:00Z)
• Are Users More Willing to Use Formally Verified Password Managers? [46.01440321321548]
  We design and implement two experiments to understand how formal verification impacts users.<n>We focus on the application domain of password managers since it has been documented that the lack of trust in password managers might lead to lower adoption.<n>We conclude that formal verification is seen as desirable by users and identify three actional recommendations to improve formal verification communication efforts.
  arXiv  Detail & Related papers  (2025-04-02T20:57:49Z)
• Why Johnny Signs with Next-Generation Tools: A Usability Case Study of Sigstore [10.88933151812096]
  We conducted a usability study of Sigstore, a pioneering and widely adopted exemplar of next-generation signing.<n>We examined (1) the problems and advantages associated with practitioners' tooling choices, (2) how and why their signing-tool usage has evolved over time, and (3) the contexts that cause usability concerns.<n>Our findings illuminate the usability factors of next-generation signing tools and yield recommendations for toolmakers, adopting organizations, and the research community.
  arXiv  Detail & Related papers  (2025-03-01T00:59:18Z)
• DiVerify: Hardening Identity-Based Software Signing with Programmable Diverse-Context Scopes [11.521573335215239]
  State-of-the-art identity-based code signing schemes have a major shortcoming.<n>They fail to provide verifiable information about the context in which a signature is generated.<n>We propose a diverse identity verification approach that reduces reliance on a single source of verification.
  arXiv  Detail & Related papers  (2024-06-21T18:53:52Z)
• Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors [4.944550691418216]
  Package maintainers can guarantee package authorship through software signing. It is unclear how common this practice is, and whether the resulting signatures are created properly.
  arXiv  Detail & Related papers  (2024-01-26T03:55:36Z)
• On the Security Blind Spots of Software Composition Analysis [46.1389163921338]
  We present a novel approach to detect vulnerable clones in the Maven repository. We retrieve over 53k potential vulnerable clones from Maven Central. We detect 727 confirmed vulnerable clones and synthesize a testable proof-of-vulnerability project for each of those.
  arXiv  Detail & Related papers  (2023-06-08T20:14:46Z)
• FedSOV: Federated Model Secure Ownership Verification with Unforgeable Signature [60.99054146321459]
  Federated learning allows multiple parties to collaborate in learning a global model without revealing private data. We propose a cryptographic signature-based federated learning model ownership verification scheme named FedSOV.
  arXiv  Detail & Related papers  (2023-05-10T12:10:02Z)
• Secure access system using signature verification over tablet PC [62.21072852729544]
  We describe a highly versatile and scalable prototype for Web-based secure access using signature verification. The proposed architecture can be easily extended to work with different kinds of sensors and large-scale databases.
  arXiv  Detail & Related papers  (2023-01-11T11:05:47Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.