Signing Commits and Tags

Signing Commits and Tags

Signing a commit or tag proves who really made it. Git signs data with GPG or SSH keys.

Why sign?

Anyone can set any name and email in git config. Signing uses cryptography, so a signed commit can be verified as genuinely yours.

Generate a GPG key

gpg --full-generate-key

Follow the prompts to create your key pair.

Add the public key to GitHub

1. Copy your GPG public key: gpg --armor --export your-email.
2. Paste it into GitHub Settings > SSH and GPG keys.

Configure Git to sign

git config --global user.signingkey your-key-id
git config --global commit.gpgsign true

Sign commits and tags

git commit -S -m "Signed commit"
git tag -s v1.0

The -S flag signs the commit, and -s signs the tag.

Verify a signature

git log --show-signature

This shows "Good signature" for commits signed with a key GitHub trusts.

TL;DR

• Signing proves a commit or tag really came from you.
• Set up a GPG key and add the public key to GitHub.
• Sign commits with git commit -S and tags with git tag -s.
• Verify with git log --show-signature.