Git Signing Commits & Tags
In this page:
Why Sign Commits
A GPG-signed commit cryptographically proves it was authored by the holder of a specific private key, giving reviewers and CI systems a way to verify authorship beyond the easily-spoofed name/email fields in a commit's metadata -- important for supply-chain trust on shared or open-source projects.
Example: Why Sign Commits
git commit -S -m "Signed commit proving authorship"Configuring Git to Sign
Once a GPG key exists, Git needs to be told which key to use and, optionally, to sign every commit automatically rather than requiring the -S flag on each command individually.
Example: Configuring Git to Sign
git config --global user.signingkey ABCD1234
git config --global commit.gpgsign trueSigning a Commit
With signing configured, a normal commit workflow is unchanged except that Git attaches a cryptographic signature you can verify later -- the commit message and diff themselves aren't encrypted, only authenticated.
Example: Signing a Commit
git commit -S -m "Fix login bug"Signing Tags
Release tags benefit from signing even more than regular commits, since a tag often marks the exact code that gets shipped to users -- a signed tag proves the release artifact wasn't tampered with after the fact.
Example: Signing Tags
git tag -s v1.0.0 -m "Signed release"GitHub Verified Badge
When a signed commit's public key has been uploaded to your GitHub account, GitHub displays a green Verified badge next to that commit in its web UI -- an unsigned or wrongly-signed commit shows no badge, or an Unverified warning if the signature doesn't match.
Example: GitHub Verified Badge
gpg --armor --export ABCD1234
# paste into GitHub Settings > SSH and GPG keysChapter Quiz — Complete all 6 topics to unlock
0/6 topics done
Complete these topics first: