I would never use that. It uses SHA1. The problem is the hash, not the signing. A secure package identifier doesn't necessarily need to be signed. Conversel

I would never use that. It uses SHA1. The problem is the hash, not the signing. A secure package identifier doesn't necessarily need to be signed. Conversely, you must have a decent hash algorithm. Your mentioned method signs the git commit hash. A signature is only as good as the hash you use, and SHA1 is not suitable. https://blog.thoughtram.io/git/2014/11/18/the-anatomy-of-a-git-commit.html https://blog.thoughtram.io/git/2014/11/18/the-anatomy-of-a-g... Also see https://github.com/git/git/commit/721cc4314cb593e799213ad5f926a1e9fc5779b0 https://github.com/git/git/commit/721cc4314cb593e799213ad5f9...