GPG signing

Learn to sign commits with GPG.

Signing commits with GPG

GPG (GNU Privacy Guard) can be used to cryptographically sign Git commits. A signature helps verify that a commit was created using a particular GPG key.

git config --global user.signingkey KEY_ID
git config --global commit.gpgsign true

When signing is enabled, new commits are signed by default. This improves the verifiability of commits in the repository history.

Signing key and identity

For a GPG signature to be verified, Git must use the correct key. The user.signingkey setting specifies the key identity.

git config --global user.signingkey ABCD1234
git log --show-signature

The commit author information and GPG key identity should be consistent. On platforms such as GitHub, adding the public key to your account allows signatures to be displayed as verifiable.

Exercise Create a signed commit

Enable GPG signing in a Git repository. Set ABCD1234 as the signing key. Then stage security-check.txt and create a signed commit with the message Security configuration.

Show example solution

git config commit.gpgsign true
git config user.signingkey ABCD1234
git add security-check.txt
git commit -S -m "Güvenlik yapılandırması"
echo "İmzalı commit oluşturma komutu tamamlandı."

Test yourself

You want commits to be signed with GPG by default. Which Git setting enables this?
- git config --global commit.gpgsign true
- git config --global commit.verify false
- git config --global user.signingkey false
- git config --global gpg.format none
Show answer

git config --global commit.gpgsign true — <code>commit.gpgsign true</code> makes Git sign new commits by default.

Configure the signing key

git config --global user.____ ABCD1234

Show answer

git config --global user.signingkey ABCD1234

GPG signing concepts

GPG

Cryptographic key management tool
Signing

Adding a digital signature to a commit
Identity

Identity associated with a key
Public key

Shared to verify a signature

Next lesson: SSH keys

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies