Signed Commits & Tags

Anyone can set user.name and user.email in their Git config to any value. Signed commits use cryptographic keys to prove that a commit actually came from the person it claims to be from.

Why Sign Commits?

• Verification — prove that you are the author, not someone impersonating you
• Trust — maintainers can verify contributions are legitimate
• Supply chain security — protect against unauthorized code injection
• Compliance — some organizations require signed commits for auditing

How It Works

When you sign a commit, Git creates a cryptographic signature using your private key. Anyone with your public key can verify the signature is valid and the commit has not been tampered with.

GPG Signing

GPG (GNU Privacy Guard) is the traditional method for signing commits.

Setup

# Generate a GPG key
gpg --full-generate-key

# List your keys
gpg --list-secret-keys --keyid-format=long

# Tell Git which key to use
git config --global user.signingkey YOUR_KEY_ID

# Enable signing by default
git config --global commit.gpgsign true

Signing a Commit

# Sign a single commit
git commit -S -m "Add new feature"

# With gpgsign=true, all commits are signed automatically
git commit -m "Add new feature"

Signing a Tag

# Create a signed tag
git tag -s v1.0.0 -m "Release 1.0.0"

# Verify a signed tag
git tag -v v1.0.0

SSH Signing

Since Git 2.34, you can use SSH keys for signing — simpler if you already have SSH keys set up.

Setup

# Tell Git to use SSH for signing
git config --global gpg.format ssh

# Point to your SSH key
git config --global user.signingkey ~/.ssh/id_ed25519.pub

# Enable signing by default
git config --global commit.gpgsign true

After this, git commit will automatically sign with your SSH key.

Verifying Signatures

# Show signatures in the log
git log --show-signature

# Verify a specific commit
git verify-commit abc1234

# Verify a tag
git verify-tag v1.0.0

The output will show whether the signature is Good (valid key, trusted) or Bad (invalid or untrusted).

GitHub's "Verified" Badge

When you push signed commits to GitHub, they display a green Verified badge next to the commit. To set this up:

1. Generate your GPG or SSH key
2. Add the public key to your GitHub account (Settings > SSH and GPG keys)
3. Sign your commits
4. Push — GitHub verifies the signature against your uploaded key

GitHub also marks commits made through the web interface as "Verified" automatically.

GPG vs SSH Signing

Key Points

• Signed commits prove authorship cryptographically
• Use GPG for full key management or SSH for simplicity
• git commit -S signs a single commit; commit.gpgsign true signs all commits
• git log --show-signature shows verification status
• Add your public key to GitHub to get the "Verified" badge