User name and email identity — authorship, DCO, and why real identities matter

Every commit object in Git records two names and two emails: the author (who wrote the change) and the committer (who recorded the commit). For most workflows these are the same person. Both are taken from user.name and user.email in the merged config, and both become part of the commit object’s permanent metadata. This is what makes the chain of trust in Part I possible: the author line in git log is not a label the engineer typed; it is a value Git read from the configuration at the moment the commit was recorded.

Where identity comes from

The two values Git reads are user.name and user.email. They are looked up using the same scope precedence as every other config value (worktree > local > global > system) and the overrides on the command line take precedence over all of those:

git config --global user.name "Alice Engineer"
git config --global user.email "alice@corp.example.com"
git config --local user.email "alice@customer.example.com"
GIT_AUTHOR_NAME="Build Bot" GIT_AUTHOR_EMAIL="bot@example.invalid" \
  git commit -m "automated dependency bump"

The first two lines set the engineer’s stable identity at global scope. The third overrides the email at local scope for a single repository. The fourth uses environment variables to override identity for a single commit - the mechanism CI pipelines use to attribute commits to a build job rather than to the engineer whose credentials the pipeline ran under.

Why the values matter

Three production consequences follow from the fact that identity is recorded in the commit object:

• Auditability. git log --format='%an <%ae>' lists every commit author. Six months after a production incident, this list is how the audit team traces a change back to a person. A real, stable email maps to a real engineer; a placeholder email maps to no one.
• DCO / Signed-off-by. Many projects require a Signed-off-by trailer in the commit message, asserted by git commit -s. The trailer is generated by Git and reads the current name and email from the config. A commit signed off with a placeholder email is a commit that asserts an identity the signer does not own.
• Signed commits. The signing key (user.signingkey) is looked up by email when the key is stored on a per-email basis in a signing backend (SSH agent, GPG keyring). A missing or wrong email means the key cannot be found and the commit is unsigned or refused by a server-side policy.

flowchart LR
    A["user.name + user.email"] --> B["git commit"]
    C["GIT_AUTHOR_NAME + GIT_AUTHOR_EMAIL"] --> B
    D["--author flag"] --> B
    B --> E["commit object"]
    E --> F["author line"]
    E --> G["committer line"]
    E --> H["Signed-off-by trailer"]
    E --> I["signature key lookup"]

The discipline of a real identity

A real identity is one that maps to a specific human and remains stable for years. The production rules:

• Use your real work email. Not a personal email, not a shared mailbox, not noreply addresses. The audit trail is only as useful as the identity behind it.
• Never use user@example.com or ci@example.invalid as a personal identity. Placeholders are for CI jobs and bots, not for human engineers; placeholders in commit history are what an audit team uses to identify a workflow that needs fixing.
• Set identity once, at global scope, on every machine you work on. Per-repo overrides belong in local config; per-job overrides belong in the job’s environment.
• If your email changes, rewrite history only for branches you own. The author line is recorded at commit time. Renaming an old email to a new one requires git filter-repo and a force-push, both of which require coordination with anyone who has cloned the repository.

Overrides and per-commit identity

Three mechanisms can change identity for a single commit without touching the merged config:

# Override author for one commit only
git commit --author="Bob Engineer <bob@vendor.example.com>" -m "backport"

# Override both author and committer via env vars (used by CI)
GIT_AUTHOR_NAME="Build Bot" \
GIT_AUTHOR_EMAIL="bot@example.invalid" \
GIT_COMMITTER_NAME="Build Bot" \
GIT_COMMITTER_EMAIL="bot@example.invalid" \
git commit -m "automated bump"

# Override signing only for a single commit
git commit --no-gpg-sign -m "emergency rollback"

--author rewrites the author line only; the committer remains the configured identity. This is the right override for “I am committing on behalf of someone else”: the committer (you) takes responsibility for recording the change, the author (them) keeps attribution for writing it. CI pipelines use the env-var form because the override applies for the duration of the command, not for the duration of the session.

Production discipline

1. One real identity per engineer, set at global scope on every workstation. Confirm with git config --global --get user.email on every new machine.
2. One identity per CI job, set via GIT_AUTHOR_* / GIT_COMMITTER_* env vars. Never use --global from inside a CI step; that writes to a shared file on the runner.
3. Placeholders are for bots, not for humans. noreply, example.com, and example.invalid addresses belong only on automated commits.
4. Verify after every machine rebuild. A new laptop with no global config will commit with whatever identity the system provides, which on some runners is root@hostname.

Quiz