Signed Git Tag Verification: Check the Signature and the Commit Before Publishing
A valid signature is only one part of release provenance. Verify the annotated tag, authorize its signer by fingerprint, compare its target with an independently approved commit, and build from that commit.
8 min read