Signing Git Commits with SSH Keys

Anyone can set user.email to your address and make commits that look like yours. Signing commits proves they were made by someone holding your private key. Git supports signing with SSH keys, which is much simpler than setting up GPG.

1. Tell Git to sign with SSH

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true

Don't have a key? Create one with ssh-keygen -t ed25519 -C "you@example.com".

2. Add the key to GitHub as a signing key

In GitHub settings under SSH and GPG keys, add the same public key again with the key type Signing Key. (Authentication keys and signing keys are registered separately, even if they're the same key.)

3. Commit and check

git commit -m "Add coupon validation"
git log --show-signature -1

On GitHub, the commit now shows a Verified badge.

Verify locally

To verify other people's SSH signatures locally, list trusted keys in an allowed-signers file:

echo "asha@example.com $(cat ~/.ssh/id_ed25519.pub)" >> ~/.config/git/allowed_signers
git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers
git verify-commit HEAD

Require signatures

• GitHub branch rules can require signed commits on protected branches.
• Use a hardware security key (ssh-keygen -t ed25519-sk) to make the signing key impossible to copy.
• Enable GitHub's vigilant mode to mark unsigned commits attributed to you as "Unverified".

Signing is one piece of software supply-chain security, alongside protected branches, required reviews and signed build artifacts.