Set Up Signed Commits for GitHub

Set Up Signed Commits for GitHub.md

Set Up Signed Commits for GitHub

I opted to use an SSH key for signing, mainly because I already had one set up for cloning/pulling/pushing. It also seemed the easiest setup compared to the GPG stuff.

---

1. Run

   git config --global gpg.format ssh
   git config --global user.signingkey ~/.ssh/<KEY_NAME>.pub
   git config --global commit.gpgsign true

   • Note: If you have multiple configs via includeIf, and you only want signing for specific hosts, move the newly added items in your ~/.gitconfig to the other host-specific config file.
   • Note: If you're on Windows, the signingkey path should be formatted like "C:/Users/<USER>/.ssh/<KEY_NAME>.pub". Surrounded in double quotes, and using forward slashes.

2. Go to SSH and GPG keys

   • Click on New SSH key

     Title: (use the same title you used for this key previously)
     Key type: Signing Key (previously it was added only as an Authentication Key)
     Key: (paste the contents of your `.pub` key file)
     
     (click Add SSH Key)
     

     You should now have your key in the Authentication Key section (from when it was originally added), and in the Signing Key section.

3. Add a new commit to a repo and push it up. You should now see the Verified badge on that commit.