[Submitted on 15 Apr 2026 (v1), last revised 23 Jul 2026 (this version, v3)]

View PDF HTML (experimental)

Abstract:Securing the open-source software supply chain requires verifying the provenance of every code contribution. While end-to-end (E2E) cryptographic commit signing is widely promoted to achieve this, little is known about how developers actually use it at scale. We fill this gap by analyzing 2,737,649 GitHub accounts, identifying 71,694 active contributors, and examining 16,112,439 commits across 874,198 repositories to characterize their commit-signing and key-management practices throughout GitHub's history. We demonstrate that the vast majority of signed activity is generated automatically by GitHub's web interface rather than by individual developers. Genuine E2E commit signing is exceptionally rare, and the few developers who adopt it practice it erratically, frequently abandoning it over time or leaving expired keys unrevoked. Ultimately, we show that manual key management creates a false sense of security across the open-source community, and we outline structural platform interventions to resolve this failure.

Submission history

From: Abubakar Sadiq Shittu [view email]
[v1] Wed, 15 Apr 2026 15:57:07 UTC (1,229 KB)
[v2] Thu, 30 Apr 2026 07:12:21 UTC (1,027 KB)
[v3] Thu, 23 Jul 2026 22:59:47 UTC (600 KB)