Study reveals commit signing rarely used authentically on GitHub despite security push

A large-scale study of GitHub's commit-signing practices has uncovered a significant gap between the security promise of cryptographic verification and how developers actually protect their code contributions. Researchers examining nearly 2.7 million GitHub accounts and over 16 million commits found that genuine end-to-end (E2E) commit signing remains exceptionally rare, and when developers do adopt it, they often abandon it or mismanage their cryptographic keys.

The scale of the problem#

The analysis encompassed 874,198 repositories and tracked commit-signing practices across GitHub's entire history. The findings paint a troubling picture: while cryptographic commit signing is widely promoted as essential to securing the open-source supply chain, the vast majority of developers either do not use it or leave their keys unmanaged. The few who do sign commits manually often practice it inconsistently, leaving expired keys unrevoked and eventually stopping the practice altogether.

Automated systems dominate the picture#

Perhaps most revealing is that most signed activity comes from GitHub's automated web interface rather than individual developers. This automation, while convenient, shifts the security burden away from direct developer control and raises questions about whether it achieves the protective intent of E2E signing in the first place.

Why this matters for security#

The research demonstrates that manual key management creates a false sense of security within the open-source community. Developers and organizations may believe their code contributions are cryptographically verified when, in reality, the practice is too sparse and poorly executed to meaningfully strengthen supply chain integrity. The study proposes structural platform interventions—changes to how GitHub itself handles key management and commit verification—to address this widespread failure.

The findings highlight a critical disconnect: the tools and practices that researchers recommend for securing open-source software have not translated into widespread, sustainable adoption among real-world developers.