{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/github-commit-signature-persistent-verification-record/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/",
        "slug": "github-commit-signature-persistent-verification-record",
        "url": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/github-commit-signature-persistent-verification-record/"
        },
        "title": "Interpret a GitHub Verified commit using its original verification record",
        "summary": "A retained verification badge is evidence of the recorded signature check, not a fresh approval of the code.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:37+00:00",
        "modified_at": "2026-10-20T18:34:31+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 275,
        "potentially_affected": "This concerns GitHub’s displayed signature-verification record. It does not establish that a change was reviewed, is free from defects, or remains authorized under the organization’s current key policy.",
        "dse_recommendation": "DSE recommends recording the commit identity and verification timestamp alongside the required review and release evidence.",
        "primary_source": {
            "name": "GitHub — About commit signature verification",
            "url": "https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification",
            "published_on": null,
            "authority": "docs.github.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A retained verification badge is evidence of the recorded signature check, not a fresh approval of the code.</p>\n<h2>Source facts</h2>\n<p>GitHub supports cryptographic verification of GPG, SSH and S/MIME commit signatures. Once verified, a persistent record remains within the repository network, including a verification timestamp. GitHub states that later key revocation, expiry or changes do not retroactively change that recorded status. Signing differs from a commit signoff, and vigilant mode adds its own displayed status distinctions.</p>\n<p>Source: <a href=\"https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification\">GitHub — About commit signature verification</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns GitHub’s displayed signature-verification record. It does not establish that a change was reviewed, is free from defects, or remains authorized under the organization’s current key policy.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends recording the commit identity and verification timestamp alongside the required review and release evidence. Define how key revocation affects future acceptance without assuming historical badges will disappear. Keep signature policy, developer authorization and code review as separate controls. Train reviewers to recognize the relevant status and to investigate an unexpected author or signer rather than accepting a green badge alone. Write a policy example for a historically verified commit whose signing key is no longer approved for new work. Ask reviewers to distinguish the recorded signature result from present release authorization, and keep the current acceptance decision alongside the commit identifier.</p>\n<h2>Verification</h2>\n<p>Proposed verification: using authorized test commits, compare signing status, signer identity and the available verification timestamp. Exercise the repository’s intended acceptance checks in a test branch. Retain the observed metadata and current policy decision, and verify functional review evidence separately from the cryptographic origin check.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification\">GitHub — About commit signature verification</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A retained verification badge is evidence of the recorded signature check, not a fresh approval of the code.\nSource facts\nGitHub supports cryptographic verification of GPG, SSH and S/MIME commit signatures. Once verified, a persistent record remains within the repository network, including a verification timestamp. GitHub states that later key revocation, expiry or changes do not retroactively change that recorded status. Signing differs from a commit signoff, and vigilant mode adds its own displayed status distinctions.\nSource: GitHub — About commit signature verification.\nApplicability\nThis concerns GitHub’s displayed signature-verification record. It does not establish that a change was reviewed, is free from defects, or remains authorized under the organization’s current key policy.\nDSE recommendation\nDSE recommends recording the commit identity and verification timestamp alongside the required review and release evidence. Define how key revocation affects future acceptance without assuming historical badges will disappear. Keep signature policy, developer authorization and code review as separate controls. Train reviewers to recognize the relevant status and to investigate an unexpected author or signer rather than accepting a green badge alone. Write a policy example for a historically verified commit whose signing key is no longer approved for new work. Ask reviewers to distinguish the recorded signature result from present release authorization, and keep the current acceptance decision alongside the commit identifier.\nVerification\nProposed verification: using authorized test commits, compare signing status, signer identity and the available verification timestamp. Exercise the repository’s intended acceptance checks in a test branch. Retain the observed metadata and current policy decision, and verify functional review evidence separately from the cryptographic origin check.\nOfficial reference\nGitHub — About commit signature verification. Reviewed October 20, 2026.",
        "content_markdown": "A retained verification badge is evidence of the recorded signature check, not a fresh approval of the code.\n\n## Source facts\n\nGitHub supports cryptographic verification of GPG, SSH and S/MIME commit signatures. Once verified, a persistent record remains within the repository network, including a verification timestamp. GitHub states that later key revocation, expiry or changes do not retroactively change that recorded status. Signing differs from a commit signoff, and vigilant mode adds its own displayed status distinctions.\n\nSource: [GitHub — About commit signature verification](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification).\n\n## Applicability\n\nThis concerns GitHub’s displayed signature-verification record. It does not establish that a change was reviewed, is free from defects, or remains authorized under the organization’s current key policy.\n\n## DSE recommendation\n\nDSE recommends recording the commit identity and verification timestamp alongside the required review and release evidence. Define how key revocation affects future acceptance without assuming historical badges will disappear. Keep signature policy, developer authorization and code review as separate controls. Train reviewers to recognize the relevant status and to investigate an unexpected author or signer rather than accepting a green badge alone. Write a policy example for a historically verified commit whose signing key is no longer approved for new work. Ask reviewers to distinguish the recorded signature result from present release authorization, and keep the current acceptance decision alongside the commit identifier.\n\n## Verification\n\nProposed verification: using authorized test commits, compare signing status, signer identity and the available verification timestamp. Exercise the repository’s intended acceptance checks in a test branch. Retain the observed metadata and current policy decision, and verify functional review evidence separately from the cryptographic origin check.\n\n## Official reference\n\n[GitHub — About commit signature verification](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/",
                "url": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Interpret a GitHub Verified commit using its original verification record",
                        "item": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/#article",
                "identifier": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/",
                "url": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/",
                "headline": "Interpret a GitHub Verified commit using its original verification record",
                "description": "A retained verification badge is evidence of the recorded signature check, not a fresh approval of the code.",
                "abstract": "A retained verification badge is evidence of the recorded signature check, not a fresh approval of the code.",
                "articleBody": "A retained verification badge is evidence of the recorded signature check, not a fresh approval of the code.\nSource facts\nGitHub supports cryptographic verification of GPG, SSH and S/MIME commit signatures. Once verified, a persistent record remains within the repository network, including a verification timestamp. GitHub states that later key revocation, expiry or changes do not retroactively change that recorded status. Signing differs from a commit signoff, and vigilant mode adds its own displayed status distinctions.\nSource: GitHub — About commit signature verification.\nApplicability\nThis concerns GitHub’s displayed signature-verification record. It does not establish that a change was reviewed, is free from defects, or remains authorized under the organization’s current key policy.\nDSE recommendation\nDSE recommends recording the commit identity and verification timestamp alongside the required review and release evidence. Define how key revocation affects future acceptance without assuming historical badges will disappear. Keep signature policy, developer authorization and code review as separate controls. Train reviewers to recognize the relevant status and to investigate an unexpected author or signer rather than accepting a green badge alone. Write a policy example for a historically verified commit whose signing key is no longer approved for new work. Ask reviewers to distinguish the recorded signature result from present release authorization, and keep the current acceptance decision alongside the commit identifier.\nVerification\nProposed verification: using authorized test commits, compare signing status, signer identity and the available verification timestamp. Exercise the repository’s intended acceptance checks in a test branch. Retain the observed metadata and current policy decision, and verify functional review evidence separately from the cryptographic origin check.\nOfficial reference\nGitHub — About commit signature verification. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:37+00:00",
                "dateModified": "2026-10-20T18:34:31+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/github-commit-signature-persistent-verification-record/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Interpret a GitHub Verified commit using its original verification record"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 275,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GitHub — About commit signature verification",
                    "url": "https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification"
                }
            }
        ]
    }
}