Git Verify-Commit Command (with examples)
Introduction
Git is a widely used version control system that provides mechanisms for verifying the integrity of commits. The git verify-commit command is used to check whether commits have been verified with a GPG (GNU Privacy Guard) signature. This ensures that the commit hasn’t been tampered with and is associated with a trusted user. In this article, we will explore different use cases of the git verify-commit command and understand how it can be used to enhance the security of Git commits.
Use Case 1: Check commits for a GPG signature
The first use case involves using the git verify-commit command to check if commits have been signed with a GPG signature. The command accepts one or more commit hashes as arguments and verifies each commit’s signature. If no commits are verified, nothing will be printed.
Code:
git verify-commit commit_hash1 optional_commit_hash2 ...
Motivation:
Verifying the GPG signature of commits provides assurance that the commit was made by a trusted user and hasn’t been modified since it was signed. This helps prevent unauthorized changes and tampering of commit history.
Explanation:
commit_hash1 optional_commit_hash2 ...: Specifies the commit hashes for which the GPG signature should be checked. Multiple commit hashes can be provided as separate arguments.
Example Output:
commit_hash1: Verified
optional_commit_hash2: Verified
The output indicates that both commit_hash1 and optional_commit_hash2 have been verified and are associated with valid GPG signatures.
Use Case 2: Check commits for a GPG signature and show details
The second use case involves using the --verbose option with the git verify-commit command to show detailed information about each commit. This includes the commit hash, author, committer, date, and commit message.
Code:
git verify-commit commit_hash1 optional_commit_hash2 ... --verbose
Motivation:
When investigating commits, it’s often helpful to have a comprehensive view of the commit details. By using the --verbose option, detailed information about each commit can be displayed, making it easier to analyze the commit history.
Explanation:
commit_hash1 optional_commit_hash2 ...: Specifies the commit hashes for which the GPG signature and details should be checked. Multiple commit hashes can be provided as separate arguments.--verbose: Displays detailed information about each commit along with the signature verification status.
Example Output:
commit_hash1
Author: John Doe <johndoe@example.com>
Committer: John Doe <johndoe@example.com>
Date: Mon Jan 1 12:00:00 2022 +0000
Commit Message
Verification: Good signature
optional_commit_hash2
Author: Jane Smith <janesmith@example.com>
Committer: Jane Smith <janesmith@example.com>
Date: Tue Jan 2 12:00:00 2022 +0000
Commit Message
Verification: Good signature
The output displays detailed information about each commit, including the author, committer, date, commit message, and the verification status of the GPG signature.
Use Case 3: Check commits for a GPG signature and print raw details
The third use case involves using the --raw option with the git verify-commit command to print the raw details of each commit. This provides a more granular view of the commit metadata, including the raw commit object.
Code:
git verify-commit commit_hash1 optional_commit_hash2 ... --raw
Motivation:
When dealing with complex commit workflows or investigating commit metadata, having access to raw details can be invaluable. The --raw option allows users to examine the low-level details of the commits, providing a deeper understanding of the commit history.
Explanation:
commit_hash1 optional_commit_hash2 ...: Specifies the commit hashes for which the GPG signature and raw details should be checked. Multiple commit hashes can be provided as separate arguments.--raw: Prints the raw details of each commit, including the raw commit object.
Example Output:
commit_hash1
tree {tree_hash}
parent {parent_hash}
author John Doe <johndoe@example.com> 1641024000 +0000
committer John Doe <johndoe@example.com> 1641024000 +0000
Commit Message
(Commit Object)
optional_commit_hash2
tree {tree_hash}
parent {parent_hash}
author Jane Smith <janesmith@example.com> 1641110400 +0000
committer Jane Smith <janesmith@example.com> 1641110400 +0000
Commit Message
(Commit Object)
The output displays the raw details of each commit, including the tree and parent hashes, author information, committer information, commit message, and the raw commit object.
Conclusion
The git verify-commit command is a useful tool for checking the GPG signatures of Git commits. By understanding and utilizing the different use cases illustrated in this article, developers can improve the security and integrity of their commit history. Whether it’s verifying signatures, examining commit details, or exploring raw metadata, the git verify-commit command provides valuable insights into the authenticity and contents of Git commits.
