Sign your code
Tags: git, github, devops, security
Published: 2022-05-24 18:26:16

---
title: Sign your code
published: true
description: You can sign your code in Git using a GPG key.
tags: 'git, github, devops, security'
cover_image: 'https://raw.githubusercontent.com/cloudx-labs/posts/main/posts/navarroaxel/assets/sign-your-code-cover.png'
id: 1043501
---

Did you know you can sign your code in Git using a GPG key? A lot of programmers don't know they can sign their Git commits using a signature created by themselves.

## Introduction

You can use any name or email when you create a Git commit, but you can't sign a commit with a GPG key that doesn't belong to you.

### What is GPG?

The GNU Privacy Guard is an implementation of the OpenPGP standard and allows you to encrypt and sign your data and communications.

This is fully integrated with Git and you can automatically sign your code with it.

You can create a GPG key following [this guide](https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key) in GitHub. Remember that you should register it in [GitHub](https://github.com/settings/keys), or [GitLab](https://gitlab.com/-/profile/gpg_keys).

## Should I sign every commit?

There is a discussion about this, because Linus Torvalds says that when you're signing a Git tag 🏷️, you're validating all the commits in the release, signed or not. If you **automatically** sign every commit in the repository, the source of the signature loses its sense.

![Signed tag by a Node.js' member on GitHub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v4vhuivx1gicntp1khyq.png)

On the other hand, some Linux distros, like Arch Linux, uses Arch User (Git) Repositories made by users to build non-official supported packages. I mean, if you're compiling and installing a package via another user's instructions maybe you like the idea of the authors signing their work. ⚠️

![A signed commit to build the WebStorm EAP package in Arch Linux-based operating systems](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/32soj1l2q36k47w48h7a.png)

I personally like the idea of signing my open source contributions, because that's a proof of my work. Anyway, if you use GitHub to [squash your commits](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/about-pull-request-merges#squash-and-merge-your-pull-request-commits) before merging a pull request, GitHub replaces all your commits, signed or not, by a commit made by itself and signed with the GitHub GPG key. The same happens when you create code releases via the GitHub web interface.

![Signed commits in GitHub with a partially signed commit](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/obxu8v5qa0o7zythyth8.png)

## How to sign a Git commit?

First, get your key ID and copy it.

```bash
gpg --list-secret-keys --keyid-format=long
```

Then, tell Git your GPG key.

```bash
git config --global user.signingkey 3AA5C34371567BD2
```

Now, you can sign using the `-S` argument

```bash
git commit -S -am <your_commit_message>
```

and it's done! 🚀

💡 To sign every commit automatically you can use the following configuration without needing the `-S` flag:

```bash
git config --global commit.gpgsign true
```

## How to sign a Git tag?

When you create a tag locally you should add the `--sign` argument.

```bash
git tag --sign <tag_name>
```

Also, you can turn on this using the following Git configuration setting:

```bash
git config --global tag.gpgsign true
```

💡 If you only want to apply this for the repository in the current directory, remove the `--global` argument.

## Conclusion

If you work in the open source world it's a really good practice to sign your releases using a GPG key. If your work is consumed from a branch instead of a Git tag, perhaps you should sign every commit.

And, if you work in a closed source repository, you can add a rule in your CI/CD tools to only allow releases with specific GPG keys.