Commit Signing 与来源验证 | Git
本章覆盖：signed commit；signed tag；GPG / SSH signing；verification；identity vs authorization；key management；release tag；supply chain；hosting verification badge platform boundary；signing improves provenance but does not prove code is safe。
本章知识点
- signed commit
- signed tag
- GPG / SSH signing
- verification
- identity vs authorization
- key management
- release tag
- supply chain
- hosting verification badge platform boundary
- signing improves provenance but does not prove code is safe