How to sign commits in Git
Łukasz Holeczek
Follow Łukasz Holeczek on GitHub
Connect with Łukasz Holeczek on LinkedIn
Follow Łukasz Holeczek on X (Twitter)
Signing Git commits with GPG keys verifies commit authenticity and proves that commits actually came from you. As the creator of CoreUI with over 25 years of development experience, I’ve implemented commit signing for security-critical enterprise projects. The most effective solution is to generate a GPG key, configure Git to use it, and enable automatic commit signing. This approach provides cryptographic proof of commit authorship with verified badges on hosting platforms.
Generate a GPG key and configure Git to sign commits automatically.
# Generate GPG key
gpg --full-generate-key
# Choose RSA and RSA, 4096 bits, no expiration (or your preference)
# Enter your name and email (must match Git config)
# List GPG keys
gpg --list-secret-keys --keyid-format=long
# Output shows:
# sec rsa4096/YOUR_KEY_ID 2024-01-01 [SC]
# Copy YOUR_KEY_ID from the output
# Configure Git to use your GPG key
git config --global user.signingkey YOUR_KEY_ID
# Enable automatic commit signing
git config --global commit.gpgsign true
# Export public key to add to GitHub
gpg --armor --export YOUR_KEY_ID
# Make a signed commit
git commit -S -m "Signed commit message"
# Verify commit signatures
git log --show-signature
# For macOS, tell GPG where to prompt for passphrase
echo 'export GPG_TTY=$(tty)' >> ~/.zshrc
source ~/.zshrc
# For Linux/macOS, configure GPG agent
echo 'use-agent' >> ~/.gnupg/gpg.conf
After generating your GPG key, configure Git to use it for signing. The -S flag signs individual commits, but enabling commit.gpgsign signs all commits automatically. Add your public GPG key to GitHub/GitLab in Settings > SSH and GPG keys to show verified badges. Your commits will display a “Verified” badge confirming cryptographic authenticity.
Best Practice Note
This is the same commit signing we require for CoreUI security-critical repositories. Always back up your GPG key securely and use a strong passphrase. If you lose the key, you won’t be able to sign commits with the same identity. For team environments, document the GPG key setup process to ensure consistent commit verification across all contributors.
