GPG signing
- Git course
- Expert
- Lesson 25/32
- 4 min
Learn to sign commits with GPG.
Signing commits with GPG
GPG (GNU Privacy Guard) can be used to cryptographically sign Git commits. A signature helps verify that a commit was created using a particular GPG key.
git config --global user.signingkey KEY_ID
git config --global commit.gpgsign trueWhen signing is enabled, new commits are signed by default. This improves the verifiability of commits in the repository history.
Signing key and identity
For a GPG signature to be verified, Git must use the correct key. The user.signingkey setting specifies the key identity.
git config --global user.signingkey ABCD1234
git log --show-signatureThe commit author information and GPG key identity should be consistent. On platforms such as GitHub, adding the public key to your account allows signatures to be displayed as verifiable.
Practice Create a signed commit
Enable GPG signing in a Git repository. Set ABCD1234 as the signing key. Then stage security-check.txt and create a signed commit with the message Security configuration.
Starter code
# GPG imzalama ayarlarını yapılandır
# Dosyayı ekle ve imzalı commit oluşturSample solution
git config commit.gpgsign true
git config user.signingkey ABCD1234
git add security-check.txt
git commit -S -m "Güvenlik yapılandırması"
echo "İmzalı commit oluşturma komutu tamamlandı."Expected output
İmzalı commit oluşturma komutu tamamlandı.
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 You want commits to be signed with GPG by default. Which Git setting enables this?
- git config --global commit.gpgsign true Correct answer
- git config --global commit.verify false
- git config --global user.signingkey false
- git config --global gpg.format none
Explanation: <code>commit.gpgsign true</code> makes Git sign new commits by default.
2 Configure the signing key
git config --global user.____ ABCD1234git config --global user.signingkey ABCD1234Explanation: <code>user.signingkey</code> specifies the GPG key Git will use to sign commits.
3 GPG signing concepts
| Term | Meaning |
|---|---|
GPG |
Cryptographic key management tool |
Signing |
Adding a digital signature to a commit |
Identity |
Identity associated with a key |
Public key |
Shared to verify a signature |