Signing Commits

Sign commits with GPG or SSH so GitHub marks them Verified.

Syntaxgit commit -S -m "message"

Anyone can set any name and email in Git, so a commit's author is not proof of identity. Signing commits cryptographically proves they really came from you; GitHub then shows a green Verified badge.

How it works

  1. Create a GPG or SSH signing key.
  2. Add its public key to GitHub under SSH and GPG keys.
  3. Tell Git to sign commits.

You can require signed commits on protected branches for extra assurance.

Example

Example · bash
# Use an SSH key for signing
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgSign true

# Commits are now signed and show as Verified on GitHub
git commit -m "Add signed commit"

When to use it

  • A company requires GPG-signed commits on main so they can cryptographically verify that commits came from authenticated team members.
  • A developer enables vigilant mode on GitHub to mark any unsigned commit as unverified, making spoofed author names visible.
  • An open-source project requires SSH-signed commits to ensure that release tags are provably from the maintainer's machine.

More examples

Generate GPG key and configure Git

Generates a GPG key, finds its ID, and configures Git to sign every commit automatically with that key.

Example · bash
# Generate a new GPG key
gpg --full-generate-key

# Get the key ID
gpg --list-secret-keys --keyid-format=long
# sec   rsa4096/3AA5C34371567BD2

# Tell Git to use it
git config --global user.signingkey 3AA5C34371567BD2
git config --global commit.gpgsign true

Export GPG public key to GitHub

Exports the public key in ASCII-armored format for uploading to GitHub, enabling the 'Verified' badge on signed commits.

Example · bash
gpg --armor --export 3AA5C34371567BD2
# -----BEGIN PGP PUBLIC KEY BLOCK-----
# ...
# Paste this into GitHub Settings > SSH and GPG keys

Sign commits with SSH key instead

Configures Git to use the SSH key for commit signing, which is simpler than GPG for developers already using SSH authentication.

Example · bash
# Use existing SSH key for signing
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

# Make a signed commit
git commit -S -m "chore: update dependencies"

Related

gh https vs sshgh commit messages

Discussion

  • Be the first to comment on this lesson.
Signing Commits — GitHub | SoundsCode