Signing git commits and tags with an SSH key

git-ssh-signing.md

Imperative configuration example:

git config gpg.format ssh
git config user.signingKey /path/to/private/ed25519key
git commit -S -m "signed commit"
git tag --sign --annotate -m "signed tag" v0.1.0

Now we can verify the signatures with allowed_signers file:

git config gpg.ssh.allowedSignersFile /path/to/allowed_signers
git verify-tag v0.1.0
echo $?

Format of the allowed_signers file can be found in man page of ssh-keygen

alice@example.com valid-after="202401011200Z",valid-before="202512311159Z" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGfExampleKeyDataHere

Declarative configuration example:

[user]
	name = alice
	email = alice@example.com
	signingKey = ~/.ssh/id_ed25519.pub
[gpg]
	format = ssh
[gpg "ssh"]
	allowedSignersFile = ~/.ssh/allowed_signers
[commit]
	gpgsign = true
[tag]
	gpgsign = true