How does commit signing work?

Question

I am currently wondering how git commit signing exactly works.

Tried to find this out but could not find any exact technical documentation. I am aware how to do git commit signing but am wondering what exactly git does to sign a commit.

What exactly is it that is signed? Is it the full data inside the repository at the given commit, so the data like the commit message etc. and the data of all files? Or is it only the commit with pointers to the contained files etc?

Answer 1

Although it's not documented anywhere, examination of the source code shows that it's the entire contents of the commit object. Those contents then get modified to insert the signature, so that the verification process must strip out the signature into a separate buffer and pass the original, pre-signature-insertion, data to the GPG signer.

The GPG signature data then take place in calculating the SHA-1 checksum for the commit to become the commit's hash ID. See gpg-interface.c and commit.c, functions sign_buffer and do_sign_commit respectively. The tag signing is in builtin/tag.c (see function do_sign and its caller); signed tags have their signatures appended rather than inserted, but otherwise this works pretty much the same way.