Step-by-step guide to automatically sign Git commits with SSH keys and display the Verified badge on GitHub.

git-ssh-commit-signing-setup.md

🔐 Git SSH Commit Signing Setup

Automatically sign all your Git commits and get the ✅ Verified badge on GitHub.

---

Prerequisites

• Git installed
• A GitHub account

---

Step 1 — Generate an SSH Key

ssh-keygen -t ed25519 -C "[email protected]"

• Press Enter to accept the default path (~/.ssh/id_ed25519)
• Optionally, set a passphrase for extra security or press Enter to skip

---

Step 2 — Add Your Key to the SSH Agent

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

---

Step 3 — Add SSH Key to GitHub for Authentication

1. Copy your public key:

cat ~/.ssh/id_ed25519.pub

2. On GitHub: Settings → SSH and GPG keys → New SSH key

Field	Value
Title	e.g. My Laptop
Key type	Authentication Key
Key	Paste your public key

---

Step 4 — Add the Same Key as a Signing Key

1. Go to GitHub: Settings → SSH and GPG keys → New SSH key

Field	Value
Title	e.g. My Laptop (Signing)
Key type	Signing Key
Key	Paste the same public key

✅ You can use the same key for both authentication and signing.

---

Step 5 — Configure Git to Auto-Sign Commits

git config --global user.name "Your Name"
git config --global user.email "[email protected]"
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

---

Step 6 — Enable Vigilant Mode on GitHub

Go to GitHub: Settings → SSH and GPG keys → Vigilant mode

✅ Check "Flag unsigned commits as unverified"

This ensures all commits in your repositories show a verification badge.

---

Step 7 — Verify Your Setup

git commit -m "test: signed commit"
git log --show-signature -1

Expected output:

Good "git" signature for [email protected] with ED25519 key SHA256:...

And you’ll see a ✅ Verified badge in GitHub commit history.

---

Quick Summary

Step	Action
1	Generate SSH key with ssh-keygen
2	Add key to SSH agent
3	Add to GitHub as Authentication Key
4	Add to GitHub as Signing Key
5	Configure Git to auto-sign commits
6	Enable Vigilant Mode on GitHub
7	Test with git log --show-signature

---

Tips & Tricks 💡

• Multiple machines: Repeat Steps 1–5 or securely copy your ~/.ssh/id_ed25519 key.
• Check Git config anytime:

git config --global --list | grep -E "gpg|sign|signing"

• View existing SSH keys before generating new ones:

ls -al ~/.ssh

---

References

• GitHub Docs — Commit Signature Verification
• GitHub Docs — Displaying Verification Statuses
• GitHub Docs — Generating a New SSH Key