How to enable GPG signing in Git
Łukasz Holeczek
Follow Łukasz Holeczek on GitHub
Connect with Łukasz Holeczek on LinkedIn
Follow Łukasz Holeczek on X (Twitter)
Enabling GPG signing for Git commits ensures commit authenticity and maintains security in collaborative projects and open-source repositories. As the creator of CoreUI, a widely used open-source UI library, I’ve enforced commit signing in production repositories throughout my 25 years of development experience. The most straightforward approach is configuring Git to automatically sign all commits with your GPG key. This method provides cryptographic proof of authorship for every commit you make.
Configure Git to sign all commits automatically with your GPG key.
git config --global user.signingkey YOUR_GPG_KEY_ID
git config --global commit.gpgsign true
Here the first command sets your GPG key ID as the default signing key for Git. The second command enables automatic GPG signing for all commits globally. Replace YOUR_GPG_KEY_ID with your actual key ID from gpg --list-secret-keys --keyid-format=long. After configuration, every commit you create will be automatically signed with your GPG key without additional flags.
Best Practice Note:
This is the same configuration we require for CoreUI maintainers to ensure commit authenticity. Always backup your GPG private key securely, add your public key to GitHub/GitLab for verified badges, and configure your GPG agent to cache your passphrase to avoid repeated password prompts.
