Signing Git commits using GPG Keys

Why should we sign a Git commit ?

Git does not inherently verify who you are. You can do:

git config user.name "Linus Torvalds"
git config user.email "linus@linux-foundation.org"

That’s it. Now your commit shows that you are Linus Torvalds. If it is the real Linus, I would blindly merge the code into my repo, but how do I know that its really him? That’s where digital signatures come into picture.

What is GPG ?

GPG (GNU Privacy Guard, part of the GNU Project) is a tool that lets you prove your identity (authentication), protect integrity (integrity) and encrypt data (confidentiality) via Public Key cryptography. Let us focus on how authentication works in this article. GPG lets you generate a pair of keys, one private and another public. As the names imply, private key must be kept safely with you and public key can be with anyone. If your private key is compromised, you are not secure anymore and have to generate a new pair. Authentication and digital signature in public key cryptography system are designed such that;

1. One who wants to prove their identity will sign the commit using private key. (since no one else holds the private key)
2. Anyone can verify that this sign is legitimate using the public key.

Read *https://en.wikipedia.org/wiki/Public-key_cryptography *for more info.

Steps to sign a commit

1. Install GPG

Open your terminal and run one of the following commands based on your OS.

# linux
sudo apt install
sudo apt install gnupg

# mac
brew install gnupg  

If you are on Windows, you need to download it from https://gpg4win.org

Restart the terminal and verify the installation;

gpg --version

2. Generate key pair

gpg --full-generate-key

This command will ask you the following:

• key type (preferably RSA and RSA)
• key size (longer the better, usually 4096)
• expiration date (choose default)
• name and email (these are your identity)
• passphrase (this guards your keys, make sure its strong)

This generates you a key pair and stores it.

3. List your keys and copy the key ID

gpg --list-secret-keys --keyid-format=long

You will see something like this:

sec   rsa4096/ABCDEF1234567890 2026-01-26 [SC]
      1234ABCD5678EF901234567890ABCDEF12345678
uid   [ultimate] Your Name <you@email.com>

Copy the key ID, here it is ABCDEF1234567890.

4. Export your public key

gpg --armor --export <keyID> 

Replace keyID with your KeyID, here it is ABCDEF1234567890. This will print a block like:

-----BEGIN PGP PUBLIC KEY BLOCK-----
...
-----END PGP PUBLIC KEY BLOCK-----

This block shows you the public key. Copy the entire block including the first and last lines.

5. Add the public key to GitHub

Now when we sign a commit, we need to let GitHub verify our identity. So we provide it with our public key. Go to https://github.com/settings/gpg/new. Enter a title to your new GPG Key and paste the whole copied block in the ‘Key’ text area.

6. Tell Git to use this key

In this step, we will configure git to use the private key from this key pair to sign any future commit.

git config --global user.signingkey <keyID>

Replace keyID with your keyID, here it is ABCDEF1234567890.

7. Make a signed commit

Add -S flag to the usual commit command to sign it.

git commit -S -m "your commit message"

8. Verify the signature

You can do this two ways. One is locally and the other is on GitHub.

Locally you can run this to look at the logs, it shows who signed which commit.

git log --show-signature

Or, when you push your commit on to GitHub, navigate to your commit history and it will show you a “verified” label on the commits.

taken from an OSS

9. Enable auto signing

If everything is perfect till step-8, you can enable auto signing for future commits using this command.

git config --global commit.gpgsign true

Finally, while this system does not prevent from identity spoofing as shown in beginning, it will give you the power to verify the user who pushed the code on to a repo and take actions on it accordingly.