What is the point in signing tags in git?

Question

I am quite new in git, and I have seen that it is possible to sign the tags with gpg. I understand how public key cryptography works, and I understand how to do sign the tags, but what is the point in doing it?

Answer 1

The point of signing a tag is that now anyone who has your public key can prove that you have approved that particular commit as being that particular version of the program. If they happen to trust you as being the official source of releases for that package, then they know that they got an official version of that package, not some random version that might have been backdoored by an attacker or corrupted in transit.

Answer 2

Understanding the basics of the git object model shows the value of signing tags.

The diagram below, borrowed from the Git Community Book, depicts a particular snapshot. The shaded boxes are git objects. The commit object at left refers to a tree. Think of a tree like a filesystem directory, so a tree object refers to other trees and blobs. A blob object stores file contents.

Every git object has a SHA1, a unique 40-character hex digest derived from that object's contents. The abbreviated hex strings above the objects represent their respective SHA1s.

Git objects are immutable: changing even a single bit of the object's contents changes its name. It's SHA1s all the way down. Any change to a blob requires a new tree and then in turn a new commit, so it's impossible to both slip in different contents and avoid detection. Knowing only the SHA1 of a commit gives you a precise, integrity-checked snapshot of a tree.

A commit also refers to its immediate parent (or multiple parents in the case of merges), so the guarantee is even stronger. Changing a single bit anywhere in a commit's history also changes its SHA1. Knowing only a single commit's SHA1 gives you a huge amount of information: an exact tree in the context of an exact history going all the way back to the first commit.

Anyone can create commits, and anyone can claim to be, say, Linus Torvalds. It's important to know which commits are trustworthy. A signed tag that refers to a commit gives you all of the above information along with verifiable authenticity. Many projects use signed tags as a way of stamping Officially Blessed Releases.