Git Commit Signing
Anyone can set any name and email in Git. Signing adds a cryptographic signature to a commit or tag, made with your GPG or SSH key, so others can check it really came from you.
GitHub shows signed commits with a Verified label when you have added the key to your account.
Sign a commit with an SSH key
git config gpg.format ssh
git config user.signingkey ~/.ssh/id_ed25519.pub
git commit -S -m "First release of Hello World!"
[main (root-commit) bbdefbc] First release of Hello World!
1 file changed, 1 insertion(+)
create mode 100644 index.htmlCheck the signature
To check SSH signatures locally, Git needs an allowed signers file, set with gpg.ssh.allowedSignersFile:
git log --show-signature -1
commit bbdefbc3cedc07012e3f2970e6b20b08e74040f3
Good "git" signature for test@example.com with ED25519 key SHA256:kf1Ip6knZLlFhiU/JargVR8bvfL+0qTAZG9JQM+76yE
Author: W3Schools Test <test@example.com>
Date: Thu Nov 5 11:00:07 2026 +0100
First release of Hello World!Sign Everything
Run git config commit.gpgSign true to sign every commit without -S. Sign a tag with git tag -s v1.0 -m "version 1.0" and check it with git tag -v v1.0.
