Git · Senior · Question 26 of 76
Why might a signed commit still not prove the code is safe?
- ✓Correct answer: It proves who committed, not what the code does
- 2Signatures can be removed without changing the hash
- 3Only tags can be signed, not commits
Explanation
A signature authenticates the key holder; a compromised key or a malicious maintainer still signs. Signing is one layer of supply-chain security alongside review and protected branches.