iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Signing Commits

By · Reviewed & last updated · Part of Git Tutorial

Signed commits make the question of who pushed something answerable years later. SSH signing is the modern path.

Signed commits

EXAMPLE
# 1. Choose a method
# - SSH signing (newer, simpler) - supported by GitHub
# - GPG signing (older, more setup)
# We will use SSH because the key story is simpler.

# 2. Tell git to sign with SSH
git config --global gpg.format ssh
git config --global commit.gpgsign true
git config --global tag.gpgsign true
git config --global user.signingkey ~/.ssh/id_ed25519.pub

# 3. Build an allowed_signers file so 'git log --show-signature' works locally
# Format:  <principal> namespaces=git ssh-ed25519 <pubkey>

mkdir -p ~/.config/git
cat <<'EOF' > ~/.config/git/allowed_signers
you@example.com ssh-ed25519 AAAAC3Nz...your-pubkey
EOF
git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers

# 4. Commit + sign
git commit -m 'feat: add login form'
git log --show-signature

# 5. Tell GitHub which keys can sign for your account
# GitHub -> Settings -> SSH and GPG keys -> add key as 'Signing Key'
# After that, your commits show a 'Verified' badge.

# Pushed commits appear verified once GitHub recognises the signing key.

# 6. Enforce signed commits on main
# Branch protection -> 'Require signed commits'

# 7. Web-merge UI signs with GitHub's own key, which appears Verified.

# 8. CI commits and merges
# If you let GitHub Actions push, give it a signing key:
# - Generate a deploy key dedicated to signing
# - Store the private key as a secret
# - On a workflow run, set git config user.signingkey to that key and use ssh-agent

# 9. GPG path (if your org standardises on GPG)
# gpg --full-generate-key
# git config --global gpg.format openpgp
# git config --global user.signingkey <key-id>
# Add the public key in GitHub -> SSH and GPG keys
# Use sigstore (Cosign-style keyless) for ephemeral CI signing if you can

# 10. Tag signing for releases
git tag -s v1.4.0 -m 'release 1.4.0'
git push --tags
# Verify
git tag -v v1.4.0

Why it matters

Signed commits cost ten minutes to set up and turn the question of who pushed something into a known answer. Require signed commits on main once the team has keys, and require signed tags for any release that goes to production.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Sign commits with SSH or GPG; GitHub verifies them.
git config commit.gpgsign true
Try it Yourself »

Discussion

Loading…