---
title: "Comment by Apoorv Tyagi on \"How to set up Git commit signing\" | Hashnode"
description: "Wow. Didn't know about that! But what is the significance of Github commit signing? What does it mean if I have a commit verified by the commit author?"
url: "https://hashnode.com/posts/how-to-set-up-git-commit-signing/60fe6d4c09fd155c2d3b2438/comment/60fe6f61982d8f5c560a16db"
---

[Discussion](https://hashnode.com/posts/how-to-set-up-git-commit-signing/60fe6d4c09fd155c2d3b2438)

Comment [How to set up Git commit signing](https://hashnode.com/posts/how-to-set-up-git-commit-signing/60fe6d4c09fd155c2d3b2438)

[Apoorv Tyagi](https://hashnode.com/@apoorvtyagi)

[Jul 26, 2021](https://hashnode.com/posts/how-to-set-up-git-commit-signing/60fe6d4c09fd155c2d3b2438/comment/60fe6f61982d8f5c560a16db)

Wow. Didn't know about that!

But what is the significance of Github commit signing? What does it mean if I have a commit verified by the commit author?

[Kamil Gierach-Pacanek](https://hashnode.com/@Asentinn)

[Jul 26, 2021](https://hashnode.com/posts/how-to-set-up-git-commit-signing/60fe6d4c09fd155c2d3b2438/comment/60fe6f61982d8f5c560a16db#reply-60fe997c1be2da0c4ab76c1d)

That's a good question. I believe it is more important in some bigger or more significant projects, when you want to know if commits really come from a legitimate person.

Because the private key (and passphrase) is known only to a specific person - by seeing that a commit is signed using that key, you can trust the content of this commit. Unless that person's private key is leaked and passphrase is cracked or obtained in other way, there is no possibility to create a malicious commit by an impersonating real author.

Think about such big projects like Linux Kernels. These are wide used products and the opportunity to upload a backdoor or vulnerability can be really tempting for malicious actors.

[Apoorv Tyagi](https://hashnode.com/@apoorvtyagi)

[Jul 28, 2021](https://hashnode.com/posts/how-to-set-up-git-commit-signing/60fe6d4c09fd155c2d3b2438/comment/60fe6f61982d8f5c560a16db#reply-61015a072db92534dc93349f)

Makes sense. Thanks