arXiv: Claimed or Attested? A Commit-Signature Dataset and Identity Trust Tiers across the World of Code

This publication introduces a new dataset and classification framework for assessing the trustworthiness of software code contributions based on digital signatures. The authors propose "Identity Trust Tiers" that categorize commits according to whether the author’s identity is merely claimed (self-attested) or formally attested through verified cryptographic signatures. The dataset covers millions of commits across the global open-source ecosystem, providing a practical tool for evaluating supply chain integrity.

This change directly affects any organization that relies on open-source software components, particularly in regulated sectors such as finance, healthcare, critical infrastructure, and EU digital services. Compliance teams in these sectors must now consider whether their software supply chain risk assessments adequately differentiate between signed and unsigned code contributions. The framework aligns with emerging EU AI safety and cybersecurity requirements, including the Cyber Resilience Act and AI Act obligations for transparency and traceability.

Compliance teams should immediately review their current software bill of materials (SBOM) processes to incorporate signature verification as a trust metric. They should assess whether their third-party code review policies account for identity attestation tiers, and begin mapping their open-source dependencies against the proposed classification. Proactive adoption of this framework will help demonstrate due diligence in supply chain security audits and regulatory inspections.