Git uses cryptographic signatures in various places, currently objects (tags,
commits, mergetags) and transactions (pushes). In every case, the command which
is about to create an object or transaction determines a payload from that,
calls an external program to obtain a detached signature for the payload
(gpg -bsa in the case of PGP signatures), and embeds the signature into the
object or transaction.
Signatures begin with an "ASCII Armor" header line and end with a tail line,
which differ depending on signature type (as selected by gpg.format, see
git-config(1)). These are, for gpg.format values:
-
gpg (PGP)
-
-----BEGIN PGP SIGNATURE----- and -----END PGP SIGNATURE-----.
Or, if gpg is told to produce RFC1991 signatures,
-----BEGIN PGP MESSAGE----- and -----END PGP MESSAGE-----
-
ssh (SSH)
-
-----BEGIN SSH SIGNATURE----- and -----END SSH SIGNATURE-----
-
x509 (X.509)
-
-----BEGIN SIGNED MESSAGE----- and -----END SIGNED MESSAGE-----
Signatures sometimes appear as a part of the normal payload
(e.g. a signed tag has the signature block appended after the payload
that the signature applies to), and sometimes appear in the value of
an object header (e.g. a merge commit that merged a signed tag would
have the entire tag contents on its "mergetag" header). In the case
of the latter, the usual multi-line formatting rule for object
headers applies. I.e. the second and subsequent lines are prefixed
with a SP to signal that the line is continued from the previous
line.
This is even true for an originally empty line. In the following
examples, the end of line that ends with a whitespace letter is
highlighted with a $ sign; if you are trying to recreate these
example by hand, do not cut and paste them—they are there
primarily to highlight extra whitespace at the end of some lines.
The signed payload and the way the signature is embedded depends
on the type of the object resp. transaction.