sign git commits with your ssh key, no gpg needed

why "verified" isn't just a badge

go look at your github contribution graph right now. every commit there says it's from you, with your name and your email attached. but here's the thing nobody tells new devs: git will happily let anyone type any name and any email into a commit. git author info is just text. it's not identity, it's a label. anyone with your public email (which is probably visible on your github profile right now) can clone a repo, set their git config to match your name and email, and push a commit that looks exactly like it came from you.

that's not a hypothetical edge case, it's how git has worked since day one. signing commits is the fix, and you don't need gpg's whole ceremony to do it anymore. if you already have an ssh key for github, you already have what you need.

the setup, command by command

first, tell git to use ssh instead of gpg for signing:

git config --global gpg.format ssh

this one line changes git's signing backend. normally git assumes you're signing with gpg, which means generating a separate gpg key, managing a separate keyring, and dealing with gpg's famously unfriendly ux. telling git gpg.format ssh means "use ssh signing instead," which piggybacks on the ssh key you probably already have.

next, point git at the public key you want to sign with:

git config --global user.signingkey ~/.ssh/id_ed25519.pub

note it's the public key path. git uses your ssh agent and private key to actually create the signature, but it references the public key here so it knows which keypair to use. if you've got multiple ssh keys for different purposes (work, personal, different github accounts), this is where you make sure you're pointing at the right one.

now make signing automatic so you don't have to remember to flag every commit:

git config --global commit.gpgsign true

without this, you'd have to run git commit -S every single time and inevitably forget half the time, which defeats the purpose. flip this to true once and every commit gets signed from here on out, no extra typing.

telling github the key is for signing

here's a step people miss: the ssh key you use to push to github and the ssh key github trusts for signature verification are tracked separately in github's settings, even if it's the literal same keypair. go to settings, ssh and gpg keys, and add a new key but select "signing key" as the type instead of "authentication key." paste in your public key. github now has a reference copy to check your signatures against.

once that's done, commit something and push it. you'll see a green "verified" badge next to the commit on github. that badge means github cryptographically checked the signature against the public key you registered and confirmed it matches. it's not decoration, it's proof.

what this actually protects against

signing doesn't stop someone from impersonating your name in a commit message, it stops them from faking a commit that verifies as yours. without your private key, which never leaves your machine, they cannot produce a valid signature. so the moment someone tries to pass off a malicious commit as coming from you, either it shows unverified, or it fails to verify at all, and anyone reviewing the repo can see something's off.

this matters more than it sounds like for open source maintainers, companies with compliance requirements, and honestly anyone whose commits get pulled into dependency chains. supply chain attacks love exploiting exactly this kind of unverified trust.

the takeaway

you already generated an ssh key to talk to github. you're not creating new infrastructure, you're just telling git and github to use the key you've got for a second job: proving commits are actually from you. four commands, maybe five minutes, and your commit history stops being a list of trust-me-bro claims and starts being something that can actually be checked. do this on every machine you commit from, check your signing key is still registered if you ever rotate your ssh keys, and go flip that switch before you forget again.