Git Tag Verification

Intermediate

Learner goal

By the end of this lesson, you should be able to verify a cryptographically signed Git tag, distinguish verification from ordinary tag inspection, interpret verification outcomes carefully, and explain why a valid signature does not by itself prove that a signer is the person or organization you intended.

Verification is different from inspection

`git show <tag>` displays tag information and the referenced object. It does not, by itself, establish that an embedded cryptographic signature is valid. For signature verification, the official `git tag` interface provides `-v`/`--verify`, which verifies the cryptographic signature of the named tag.

git show release-2.0
git tag -v release-2.0

git tag -v release-2.0?Git verifies the tag signature and reports the verification result

Only cryptographically signed tags have a signature to verify

An annotated tag can be unsigned or cryptographically signed. V457 covered annotated-tag creation; do not equate “annotated” with “signed.” A signed tag is created with `git tag -s` (or `-u` with a selected signing key). The current Git documentation states that the signing backend is selected by `gpg.format`; the default is OpenPGP, with X.509 and SSH also supported.

git tag -a release-unsigned -m "Unsigned release"
git tag -s release-signed -m "Signed release"
git tag -v release-signed

git tag -a release-unsigned -m "Unsigned release"?an annotated tag object exists, but no signature was created

The signing backend is part of Git configuration

Git uses `gpg.format` to select the signature format used for cryptographic signing. The current official configuration documentation lists `openpgp`, `x509`, and `ssh`. This matters when explaining verification: do not teach learners that all modern Git signatures necessarily use one external tool or one key format.

git config --get gpg.format
# unset means Git uses its documented default

git config --get user.signingKey

git config --get gpg.format?the configured signing format, or no value when the default is in effect

A successful cryptographic check is not the same as identity judgment

Verification answers a cryptographic question: whether the signature on the tag validates under the verification environment and key material available to Git. The verification output can also report trust or key-availability information. Do not turn “valid signature” into an unsupported claim that the signer is trustworthy, authorized, or the intended release owner; those are separate provenance and policy questions.

git tag -v release-signed
# Read the complete verification output, including signer/key information and any warnings.

git tag -v release-signed?read Git’s signature-validation result and associated key/trust information

Verification can fail for different reasons

Do not reduce every verification failure to “the tag is fake.” Git may be unable to validate a signature because the signature is absent, the signature is invalid, or required key material or verification support is unavailable. The exact diagnostic output is part of the result and should be preserved when investigating a real release.

git tag -v release-unsigned
# inspect the diagnostic and exit status

git tag -v release-signed

git tag -v release-signed?diagnostic output explains what Git could or could not verify

`git verify-tag` is a dedicated verification command

Git also provides `git verify-tag` as a dedicated tag-signature verification command. The official signature-format documentation lists both `git verify-tag` and `git tag -v` for verifying signed tags. Use `git tag -v` when teaching the tag interface in this lesson; recognize `git verify-tag` when reading scripts, documentation, or diagnostics elsewhere.

git verify-tag release-signed
# equivalent verification purpose for the tag signature

git verify-tag -v release-signed
# verbose form includes the tag contents before validation

git verify-tag release-signed?Git performs tag-signature verification

Verify before treating a release tag as authenticated evidence

A disciplined release check separates observations: identify the exact tag, verify its signature, capture the verification output, and then apply the project’s independent provenance or authorization rules. Do not substitute `git show`, tag naming conventions, or a familiar signer name for the cryptographic verification step.

git rev-parse refs/tags/release-2.0
git tag -v release-2.0
git show release-2.0

Practice what you learned

Use the dedicated Git code-completion exercise for this lesson.

Official-source boundary

This lesson uses the live official Git documentation only: `git-tag` for tag verification and signing options, `git-config` for `gpg.format` and related signing configuration, and `gitformat-signature` for the signature model and verification commands. The official documentation baseline currently tracks Git 2.56.0; the local executable used by Foxipa’s real-Git tests may be older, so observed test behavior is reported separately from the documentation baseline.