Claimed or Attested? A Commit-Signature Dataset and Identity Trust Tiers across the World of Code arxiv.org
It classifies World of Code commit signatures at scale, splitting claimed from attested identities and shipping provenance data.
1 comment
How do you tell a claimed identity from an attested one when the commit has a signed key but the maintainer name/email in Git is different (or changed later), is it mostly matching against a trust root somewhere?