Signing git commits with GPG

Git can sign commits and tags with a GPG key protected by Code Sign Manager. Git signing typically uses a per-user GPG Environment, so that each developer signs with their own key.

Before you begin

Set up your GPG client and sync your keys. See Configuring GPG clients with per user Environments.

Configure git

  1. List your keys to find the GPG ID of your signing key:

    $ gpg --list-secret-keys --keyid-format LONG

    /Users/sample.user/.gnupg/pubring.kbx

    ------------------------

    sec> rsa2048/BF1BCC465F6FAC71 2021-04-28 [SC]

    E315890300278201D39EFDD6BF0BCC465F6FAC70

    Card serial no. = 697A 5FDA922F

    uid [ultimate] Sample User <sample.user@example.com>

    ssb> rsa2048/F7DC721DCC61D703 2021-04-28 [A]

    ssb> rsa2048/E5A4B34360E34410 2021-04-28 [E]

    In this example, the GPG ID is BF1BCC465F6FAC71.

  2. Designate the key to use for signing:

    $ git config --global user.signingkey BF1BCC465F6FAC71

  3. Set your git email address to the email address on your GPG key:

    $ git config --global user.email sample.user@example.com

Sign commits

Sign an individual commit by adding the -S option:

$ git commit -S -m "This is a signed commit"

Configure git to sign all commits by default for a local repository:

$ git config commit.gpgsign true

Configure git to sign all commits by default in all repositories:

$ git config --global commit.gpgsign true

Verify signatures when viewing a git log:

$ git log --show-signature

Sign tags

Sign a tag by adding the -s option:

$ git tag -s v1.1.1 -m "My signed tag"

Configure git to sign all tags by default:

$ git config --global tag.gpgsign true

Verify a tag's signature:

$ git tag --verify v1.1.1

Verified commits in GitLab

GitLab shows a commit as Verified only when your public key is in your GitLab account, and the commit's committer email matches an email address that is both on your GPG key and verified in your GitLab account. GitLab 19.1 and later also show the verification status of signed tags.

If your organization uses automatic GitLab key provisioning, Code Sign Manager uploads your public key to GitLab for you. See Publishing GPG keys to GitLab automatically. Otherwise, Exporting and importing a public key and add it to your GitLab account.