$ gitpushf.uk
Git Academy

Advanced · 5 min read

Sign your commits

Prove the commits come from you, and get the “Verified” badge.

Why

Anyone can write any name and email in a commit. A signature proves who really made it.

With your SSH key (simplest)

Reuse the key you already push with, then add it on GitHub as a “Signing key”.

Safe
$ git config --global gpg.format ssh
$ git config --global user.signingkey ~/.ssh/id_ed25519.pub
$ git config --global commit.gpgsign true

Check

Local verification needs an allowed signers file; on GitHub, look for the Verified badge.

Safe
$ git log --show-signature -n 1