{ "mode": "man", "parameter": "GITFORMAT-SIGNATURE", "section": "5", "url": "https://www.chedong.com/phpMan.php/man/GITFORMAT-SIGNATURE/5/json", "generated": "2026-11-07T08:14:15Z", "synopsis": "<[tag|commit] object header(s)>\n", "sections": { "NAME": { "content": "gitformat-signature - Git cryptographic signature formats\n", "subsections": [] }, "SYNOPSIS": { "content": "<[tag|commit] object header(s)>\n\n\n", "subsections": [] }, "DESCRIPTION": { "content": "Git uses cryptographic signatures in various places, currently objects (tags, commits,\nmergetags) and transactions (pushes). In every case, the command which is about to create an\nobject or transaction determines a payload from that, calls an external program to obtain a\ndetached signature for the payload (gpg -bsa in the case of PGP signatures), and embeds the\nsignature into the object or transaction.\n\nSignatures begin with an \"ASCII Armor\" header line and end with a tail line, which differ\ndepending on signature type (as selected by gpg.format, see git-config(1)). These are, for\ngpg.format values:\n\ngpg (PGP)\n-----BEGIN PGP SIGNATURE----- and -----END PGP SIGNATURE-----. Or, if gpg is told to\nproduce RFC1991 signatures, -----BEGIN PGP MESSAGE----- and -----END PGP MESSAGE-----\n\nssh (SSH)\n-----BEGIN SSH SIGNATURE----- and -----END SSH SIGNATURE-----\n\nx509 (X.509)\n-----BEGIN SIGNED MESSAGE----- and -----END SIGNED MESSAGE-----\n\nSignatures sometimes appear as a part of the normal payload (e.g. a signed tag has the\nsignature block appended after the payload that the signature applies to), and sometimes\nappear in the value of an object header (e.g. a merge commit that merged a signed tag would\nhave the entire tag contents on its \"mergetag\" header). In the case of the latter, the usual\nmulti-line formatting rule for object headers applies. I.e. the second and subsequent lines\nare prefixed with a SP to signal that the line is continued from the previous line.\n\nThis is even true for an originally empty line. In the following examples, the end of line\nthat ends with a whitespace letter is highlighted with a $ sign; if you are trying to\nrecreate these example by hand, do not cut and paste them—they are there primarily to\nhighlight extra whitespace at the end of some lines.\n\nThe signed payload and the way the signature is embedded depends on the type of the object\nresp. transaction.\n", "subsections": [] }, "TAG SIGNATURES": { "content": "• created by: git tag -s\n\n• payload: annotated tag object\n\n• embedding: append the signature to the unsigned tag object\n\n• example: tag signedtag with subject signed tag\n\nobject 04b871796dc0420f8e7561a895b52484b701d51a\ntype commit\ntag signedtag\ntagger C O Mitter 1465981006 +0000\n\nsigned tag\n\nsigned tag message body\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQEcBAABAgAGBQJXYRhOAAoJEGEJLoW3InGJklkIAIcnhL7RwEb/+QeX9enkXhxn\nrxfdqrvWd1K80sl2TOt8Bg/NYwrUBw/RWJ+sg/hhHp4WtvE1HDGHlkEz3y11Lkuh\n8tSxS3qKTxXUGozyPGuE90sJfExhZlW4knIQ1wt/yWqM+33E9pN4hzPqLwyrdods\nq8FWEqPPUbSJXoMbRPw04S5jrLtZSsUWbRYjmJCHzlhSfFWW4eFd37uquIaLUBS0\nrkC3Jrx7420jkIpgFcTI2s60uhSQLzgcCwdA2ukSYIRnjg/zDkj8+3h/GaROJ72x\nlZyI6HWixKJkWw8lE9aAOD9TmTW9sFJwcVAzmAuFX2kUreDUKMZduGcoRYGpD7E=\n=jpXa\n-----END PGP SIGNATURE-----\n\n\n\n• verify with: git verify-tag [-v] or git tag -v\n\ngpg: Signature made Wed Jun 15 10:56:46 2016 CEST using RSA key ID B7227189\ngpg: Good signature from \"Eris Discordia \"\ngpg: WARNING: This key is not certified with a trusted signature!\ngpg: There is no indication that the signature belongs to the owner.\nPrimary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189\nobject 04b871796dc0420f8e7561a895b52484b701d51a\ntype commit\ntag signedtag\ntagger C O Mitter 1465981006 +0000\n\nsigned tag\n\nsigned tag message body\n\n", "subsections": [] }, "COMMIT SIGNATURES": { "content": "• created by: git commit -S\n\n• payload: commit object\n\n• embedding: header entry gpgsig (content is preceded by a space)\n\n• example: commit with subject signed commit\n\ntree eebfed94e75e7760540d1485c740902590a00332\nparent 04b871796dc0420f8e7561a895b52484b701d51a\nauthor A U Thor 1465981137 +0000\ncommitter C O Mitter 1465981137 +0000\ngpgsig -----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n$\niQEcBAABAgAGBQJXYRjRAAoJEGEJLoW3InGJ3IwIAIY4SA6GxY3BjL60YyvsJPh/\nHRCJwH+w7wt3Yc/9/bW2F+gF72kdHOOs2jfv+OZhq0q4OAN6fvVSczISY/82LpS7\nDVdMQj2/YcHDT4xrDNBnXnviDO9G7am/9OE77kEbXrp7QPxvhjkicHNwy2rEflAA\nzn075rtEERDHr8nRYiDh8eVrefSO7D+bdQ7gv+7GsYMsd2auJWi1dHOSfTr9HIF4\nHJhWXT9d2f8W+diRYXGh4X0wYiGg6na/soXc+vdtDYBzIxanRqjg8jCAeo1eOTk1\nEdTwhcTZlI0x5pvJ3H0+4hA2jtldVtmPM4OTB0cTrEWBad7XV6YgiyuII73Ve3I=\n=jKHM\n-----END PGP SIGNATURE-----\n\nsigned commit\n\nsigned commit message body\n\n\n\n• verify with: git verify-commit [-v] (or git show --show-signature)\n\ngpg: Signature made Wed Jun 15 10:58:57 2016 CEST using RSA key ID B7227189\ngpg: Good signature from \"Eris Discordia \"\ngpg: WARNING: This key is not certified with a trusted signature!\ngpg: There is no indication that the signature belongs to the owner.\nPrimary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189\ntree eebfed94e75e7760540d1485c740902590a00332\nparent 04b871796dc0420f8e7561a895b52484b701d51a\nauthor A U Thor 1465981137 +0000\ncommitter C O Mitter 1465981137 +0000\n\nsigned commit\n\nsigned commit message body\n\n", "subsections": [] }, "MERGETAG SIGNATURES": { "content": "• created by: git merge on signed tag\n\n• payload/embedding: the whole signed tag object is embedded into the (merge) commit object\nas header entry mergetag\n\n• example: merge of the signed tag signedtag as above\n\ntree c7b1cff039a93f3600a1d18b82d26688668c7dea\nparent c33429be94b5f2d3ee9b0adad223f877f174b05d\nparent 04b871796dc0420f8e7561a895b52484b701d51a\nauthor A U Thor 1465982009 +0000\ncommitter C O Mitter 1465982009 +0000\nmergetag object 04b871796dc0420f8e7561a895b52484b701d51a\ntype commit\ntag signedtag\ntagger C O Mitter 1465981006 +0000\n$\nsigned tag\n$\nsigned tag message body\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n$\niQEcBAABAgAGBQJXYRhOAAoJEGEJLoW3InGJklkIAIcnhL7RwEb/+QeX9enkXhxn\nrxfdqrvWd1K80sl2TOt8Bg/NYwrUBw/RWJ+sg/hhHp4WtvE1HDGHlkEz3y11Lkuh\n8tSxS3qKTxXUGozyPGuE90sJfExhZlW4knIQ1wt/yWqM+33E9pN4hzPqLwyrdods\nq8FWEqPPUbSJXoMbRPw04S5jrLtZSsUWbRYjmJCHzlhSfFWW4eFd37uquIaLUBS0\nrkC3Jrx7420jkIpgFcTI2s60uhSQLzgcCwdA2ukSYIRnjg/zDkj8+3h/GaROJ72x\nlZyI6HWixKJkWw8lE9aAOD9TmTW9sFJwcVAzmAuFX2kUreDUKMZduGcoRYGpD7E=\n=jpXa\n-----END PGP SIGNATURE-----\n\nMerge tag 'signedtag' into downstream\n\nsigned tag\n\nsigned tag message body\n\n# gpg: Signature made Wed Jun 15 08:56:46 2016 UTC using RSA key ID B7227189\n# gpg: Good signature from \"Eris Discordia \"\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189\n\n\n\n• verify with: verification is embedded in merge commit message by default, alternatively\nwith git show --show-signature:\n\ncommit 9863f0c76ff78712b6800e199a46aa56afbcbd49\nmerged tag 'signedtag'\ngpg: Signature made Wed Jun 15 10:56:46 2016 CEST using RSA key ID B7227189\ngpg: Good signature from \"Eris Discordia \"\ngpg: WARNING: This key is not certified with a trusted signature!\ngpg: There is no indication that the signature belongs to the owner.\nPrimary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189\nMerge: c33429b 04b8717\nAuthor: A U Thor \nDate: Wed Jun 15 09:13:29 2016 +0000\n\nMerge tag 'signedtag' into downstream\n\nsigned tag\n\nsigned tag message body\n\n# gpg: Signature made Wed Jun 15 08:56:46 2016 UTC using RSA key ID B7227189\n# gpg: Good signature from \"Eris Discordia \"\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189\n\n", "subsections": [] }, "GIT": { "content": "Part of the git(1) suite\n\nGit 2.43.0 07/02/2025 GITFORMAT-SIGNATURE(5)", "subsections": [] } }, "summary": "gitformat-signature - Git cryptographic signature formats", "flags": [], "examples": [], "see_also": [] }