Theory

Updated

October 30, 2026

Theory: Signatures Bind a Key to a Hash; History Still Contains Secrets

A signed commit proves a key holder produced that object. It does not encrypt the tree. A secret once hashed is in every clone that fetched it.

Invariants

  1. SSH or GPG signing covers the commit/tag object.
  2. Forges display verified if the key is uploaded.
  3. git filter-repo rewrites hashes; everyone must reclone.
  4. Pre-commit secret scanning is courtesy; rotation is mandatory.
commit hash ── signed by key K
forge matches K to account
secret blob ── still in pack until rewrite + rotate

What can break

  • Signing with a key the forge does not know.
  • Revert of a secret (blob remains).

How to read this chapter

Sign, secrets, audit trails, scanning, lab to remove a secret.