Commit signing

Every repository requires signed commits, and protected branches refuse anything else. Git signs them with the SSH key from the GitHub page.

Skip this page if your commits already show Verified on GitHub. The first block names the key to sign with. Change its path if you registered another key.

Configure Git

SSH_KEY="$HOME/.ssh/id_ed25519.pub"
git config --global gpg.format ssh
git config --global user.signingkey "$SSH_KEY"
git config --global commit.gpgsign true
git config --global tag.gpgsign true

Register the key for signing

GitHub checks signatures against signing keys only. Register your key again, as a signing key:

gh auth refresh -h github.com -s admin:ssh_signing_key
gh ssh-key add "$SSH_KEY" --type signing --title "$(hostname)"
gh auth refresh -h github.com --remove-scopes admin:ssh_signing_key

Check a signature

Trust your key locally, then sign a test commit:

mkdir -p ~/.config/git
echo "$(git config user.email) namespaces=\"git\" $(cat "$SSH_KEY")" >> ~/.config/git/allowed_signers
git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers
cd "$(mktemp -d)"
git init -q
git commit -q --allow-empty -m "test: signing"
git log --show-signature -1

The log shows Good "git" signature, and GitHub marks your next push Verified.

Keep commits signed

GitHub's Update branch button rewrites commits without your key, and the repositories refuse the result. Rebase locally instead:

git fetch origin
git rebase origin/master
git push --force-with-lease