How to verify signed commits in Git
Łukasz Holeczek
Follow Łukasz Holeczek on GitHub
Connect with Łukasz Holeczek on LinkedIn
Follow Łukasz Holeczek on X (Twitter)
Verifying signed commits ensures the authenticity of code contributions and maintains security in collaborative projects.
As the creator of CoreUI, a widely used open-source UI library, I’ve enforced commit signing in enterprise repositories throughout my 25 years of development experience.
The most straightforward method is using git log --show-signature to display GPG signature verification status for each commit.
This approach provides clear indication of whether commits are properly signed and verified.
Use git log with the –show-signature flag to verify signed commits.
git log --show-signature
Here the --show-signature flag displays GPG signature information for each commit in the log. Verified commits show “Good signature from” followed by the signer’s name and email. Unverified or unsigned commits display either no signature information or “Bad signature” warnings. You can also use git verify-commit <commit-hash> to check a specific commit’s signature validity.
Best Practice Note:
This is the same verification process we recommend for CoreUI enterprise projects requiring strict code authenticity. Configure Git to reject unsigned commits in protected branches using server-side hooks, and ensure all team members have properly configured GPG keys to maintain consistent signing across the repository.
