Security
- Git course
- Expert
- Lesson 31/32
- 6 min
Create a GPG-signed commit and push with SSH.
GPG Signing and Security with SSH
While SSH keys are used for authentication in Git, GPG signatures verify that commits were genuinely authored by you. The git commit -S -m "message" command cryptographically signs the commit object with your GPG key. Validity is verified with git log --show-signature or git verify-commit.
git config --global user.signingkey <KEY_ID>
git commit -S -m "Secure commit"
git push git@github.com:user/repo.git mainPractice GPG Signed Commit Configuration
Configure commit.gpgsign to true in the Git repository so all commits are signed by default. Then print the value of git config commit.gpgsign to the terminal.
Starter code
git init -q
# commit.gpgsign ayarını true yap
# Ayarın değerini git config ile yazdırSample solution
git init -q
git config commit.gpgsign true
git config commit.gpgsignExpected output
true
Practice SSH Remote Configuration
Add a remote named origin with the SSH URL git@github.com:acme/security-core.git. Then print the configured SSH address to the terminal using git remote get-url origin.
Starter code
git init -q
# SSH remote ekle
# Remote URL'sini ekrana yazdırSample solution
git init -q
git remote add origin git@github.com:acme/security-core.git
git remote get-url originExpected output
git@github.com:acme/security-core.git
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 Which flag is used to attach a cryptographic GPG signature when creating a commit?
- -G
- -k
- -S Correct answer
- -s
Explanation: Uppercase -S signs the commit with a GPG key; lowercase -s merely appends a Signed-off-by trailer line to the commit message.
2 Verify Commit Signature
git verify-commit ____ HEADgit verify-commit verify-commit HEADExplanation: The git verify-commit command checks the GPG signature of the specified commit to inspect the validity of the signing key.
3 Security Concepts
| Term | Meaning |
|---|---|
git commit -S |
Signs commit with GPG |
git verify-commit |
Verifies GPG signature |
SSH anahtarı |
Provides remote access |
--show-signature |
Shows signatures in log |