Git & GitHub
/Advanced
Signed Commits
Definition
Using a GPG, SSH, or S/MIME key to cryptographically sign a commit or tag. This proves to GitHub and other developers that the commit actually came from you.
Explain Like I'm New
Git is incredibly easy to trick. I can run `git config user.name "Elon Musk"` and push a commit. The commit will literally say Elon Musk wrote it. Signing a commit attaches an unbreakable cryptographic signature, and GitHub adds a green 'Verified' badge to prove you are who you say you are.
Real World Example
Enterprise companies requiring all developers to sign their commits so a hacker can't impersonate a Senior Developer and inject malicious code into the database.
Common Use Cases
- •Security compliance
- •Identity verification
Terminal Output
bash / terminal
# Tell Git to sign your commits using your SSH key
$ git config --global gpg.format ssh
$ git config --global user.signingkey ~/.ssh/id_ed25519.pub
# Tell Git to sign EVERY commit automatically
$ git config --global commit.gpgsign true
# Now, when you run git commit, it signs it!
$ git commit -m "Secure, verified commit"
Interview Questions
basic
- What visual indicator does GitHub use for signed commits?
intermediate
- Can you use the same SSH key you use for authenticating pushes to also sign your commits?