💻 computer science

Claimed or Attested? A Commit-Signature Dataset and Identity Trust Tiers across the World of Code

This paper introduces the first commit-signature dataset for the World of Code, which distinguishes between claimed and cryptographically attested developer identities to establish a precision anchor for identity trust tiers and calibrate alias mappings across a corpus of over 5.8 billion commits.

Original authors: Audris Mockus

Published 2026-07-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Audris Mockus

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the entire history of software development as a massive, global library of billions of handwritten notes. Every time a programmer saves a piece of code, they leave a note saying, "I wrote this." But here's the catch: anyone can pick up a pen and write "I am Steve Jobs" or "I am the CEO" on a note, even if they aren't. In the world of code, this is called a claim. It's just a name typed into a box; there's no proof it's true.

This paper introduces a new way to turn those shaky claims into attestations—proof that is as solid as a fingerprint.

Here is the breakdown of how they did it and what they found, using simple analogies:

1. The Problem: The "Name Tag" vs. The "Fingerprint"

In the library of code (called the "World of Code"), most notes are just claimed. If someone writes "John Smith," we have to guess if it's that John Smith or a different one, or maybe someone pretending to be him. It's like a party where everyone wears a name tag they made themselves. Impostors can wear the same name tag as a famous person, and the library has no way to tell the difference.

2. The Solution: The "Digital Seal"

The authors found a way to find the fingerprint hidden inside the library.

The Secret: When a programmer is careful, they don't just write their name; they "seal" their note with a cryptographic signature (like a wax seal on a letter, but digital). This seal is tied to a specific key they own.
The Discovery: The authors realized that the library had been storing these seals all along, but they were tucked away in the "message" section of the notes, ignored and unread. It was like finding a treasure map inside a book you've been reading for years, but never looking at the back cover.
The Extraction: They didn't need to go back to the original source files (which would be like re-reading every single book in the library). They just scanned the existing index cards (the tables) to pull out these hidden seals.

3. What They Found: The "Trust Tiers"

They sorted the billions of notes into four levels of trust, like a security clearance badge:

Tier 0 (The Claim): The note has no seal. It's just a name. "I am Bob." (49% of notes).
Tier 1 (The Platform Seal): The note was sealed by a giant machine (like GitHub's automatic system) because the user clicked a button on a website. It proves the user is who they say they are to the website, but not necessarily to the world. (50% of notes).
Tier 2 (The Personal Key): The note was sealed by a personal key that the developer controls directly. This is a strong "fingerprint." It proves, "I am definitely the person who owns this key." (Less than 1% of notes).
Tier 3 (The Cross-World Link): The personal key is also linked to a real-world identity, like a published academic paper or a verified ID. This is the "Gold Standard."

4. The "Fan-Out" Gate: Filtering the Noise

The authors noticed something interesting: Some keys are shared by hundreds of people (like a "Team Key" for a company or a robot). If a key is used by too many different people, it's not a good fingerprint for a single person.

The Filter: They built a "fan-out gate." If a key is used by more than 50 different people, they treat it as a "Team Key" and ignore it for identity purposes. If it's used by only a few people, they know it belongs to a specific individual.
The Result: This helped them separate the "real people" from the "robots and shared accounts."

5. Catching the Impostors

Because they now have these "fingerprints," they can catch liars.

The Vanity Problem: Sometimes, famous names (like "Linus Torvalds") are used by impostors.
The Test: If a name is signed by many different keys, it's a red flag. It means too many people are claiming to be that one person. The authors found that names signed by 20+ different keys are almost certainly impostors or "vanity" strings. They can now flag these automatically, replacing old lists of "bad names" with a mathematical proof of fraud.

6. Why This Matters

The authors are clear: This isn't a magic wand that fixes every name in the library.

Precision, Not Coverage: Only about 17% of the notes have these seals. Most don't.
The Anchor: Think of the library as a shaky boat. The signed notes are the anchors. They don't hold the whole boat up, but they hold it steady in the right spot.
The Benefit: For researchers trying to link software authors to academic scientists (e.g., "Did the person who wrote this code also write this paper?"), this dataset provides a "Gold Standard" to check their work. It turns a guess ("These two names look similar") into a fact ("These two people are definitely the same because they share a cryptographic key").

Summary

The paper is a tool that digs up hidden "digital fingerprints" from a massive database of code. It doesn't fix the whole database, but it creates a small, ultra-reliable layer of truth. This allows researchers to stop guessing who wrote what and start knowing for sure, especially when trying to connect the world of code with the world of science.