Appearance
Git Commit Signing with GPG
Once you understand how to encrypt and sign files, the next practical step is signing Git commits. This ensures that your commits can be verified as genuinely coming from you, which is especially useful in group projects and open-source contributions.
Why sign commits?
- Proves that a commit really comes from you
- Helps prevent impersonation in shared repositories
- GitHub/GitLab will mark signed commits as “Verified”
Even in small projects, signing commits is a good habit and demonstrates professional workflow.
How it works conceptually
- You create a commit in Git as usual.
- Git uses your private GPG key to sign the commit.
- Others (or the platform) verify the signature using your public key.
- The commit is marked as verified if everything matches.
Signing a commit does not encrypt your code — it only proves authorship.
Best practices for students
- Use the same GPG key you use for files/projects
- Add your public key to GitHub/GitLab to enable automatic verification
- Sign commits selectively if necessary (e.g., important project milestones)
- Always back up your private key and revocation certificate
Verification by others
- Anyone with your public key can verify a signed commit
- Verification ensures the commit has not been tampered with
- Platforms like GitHub/GitLab display a green “Verified” badge for signed commits
Summary
- Commit signing builds trust in collaborative projects
- Uses the same key pair you already generated for encryption/signing
- Key takeaway: signing = proof of authorship, not encryption
Next, students can reference the cheatsheet for actual commands and quick workflow examples.