How to configure verified GitHub commits?
Published: 2021-12-03 21:06:20

---
title: How to configure verified GitHub commits?
published: true
date: 2021-11-23 19:52:52 UTC
tags: 
canonical_url: https://www.kaumnen.com/p/how-to-configure-verified-github-commits
cover_image: https://dev.rodpub.com/images/189/557_main.jpg
---

 **Git** has a feature to **sign** commits. But what is commit signing? Why should you use that? Get a verified badge now!

**NOTE:** _In this blog post, it will be explained how to sign commits on GitHub, with Windows. For other git hosts, please refer to their documentation._

### Why should you sign your commits?

First off, let’s see what is git’s default behavior.

#### Git’s default behavior

By default, git commits have two properties:

- user. email — this email is also used so that GitHub can link commits with your account and show you those shiny green squares :)
- user.name — this is the name that will be shown in a commit info

Git **doesn’t verify** the info you put into those properties, it just **assumes** they are right until you set **commit signing**.

#### **What does** ↑ **this** ↑ **mean?**

**Someone else** can set those parameters **as yours** , and git will just push it remotely (there are certain repo settings you can set, but I’m talking about default behavior), **without any checks.**

It will show like **you committed** , with a picture and your email, but you didn’t! So, basically, **anyone** can set their user.email or user.name to yours, and it will look like you made the commit.

#### How to prove it is really you?

You can utilize software called [**GPG** (GNU Privacy Guard)](https://gnupg.org/). It allows you to create **public-private** key pairs, and **encrypt/sign** the data.

It is **important** to understand **public-private** key pairs.

#### What are public-private keys in terms of encryption?

**The public key** is a public one _(wow)_. No, seriously, you can share this key with **everyone**. It’s mainly used by someone else, so they can **encrypt** the message, and send it to you. Then, you **decode** and read it with your **private key**.

**The private key** is a private one _(another one)_. It’s like **a password**. Noone, except you, should ever be able to get it. It’s used to decrypt data, and leaking/exposing it would present a fatal flaw.

### How to Sign Commits in Git(Hub)

#### Prerequisites

- [Git](https://git-scm.com/downloads), or [GitHub Desktop](https://desktop.github.com/)
- [GPG utility](https://www.gnupg.org/download/)

You can verify if **GPG** is already installed by running the following command in the terminal:

- **gpg — version**

#### Generating a new GPG key

1. **Download and install** GPG command-line tools for your operating system.

2. Open **terminal**.

3. Generate an **RSA key pair** with the following command:

- **gpg --full-generate-key**

4. Select what kind of key you want.

- We will use **RSA key pair** , default one, so you can just press **Enter** to advance.

5. What keysize do you want?

- Although you can use stronger, **4096** is good, press **Enter.**

6. Key is valid for?

- I will just press **Enter** which will select default (0 — doesn’t expire)

7. Then, input your information.

- **NOTE:**  **When asked for an email, make sure to input the primary email for your GitHub account! You can also use your no-reply GitHub provided an email address, if you have your privacy settings on.**

8. Now you need to set a secure passphrase.

- **NOTE: You can also just press OK with blank fields, but it is recommended to use a password for your encryption! Keep in mind that you will have to type in a passphrase at each commit (it has some time window, but you get the idea)**

#### Copying generated key

1. Use the following command to list the long-form of GPG keys

2. **gpg --list-secret-keys --keyid-format LONG**

2. Copy the long form of your **key ID** , from the list.

- Find the long form of your key after > **4096R/** <

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1637697350816/w2jzck-Qr.png)

3. Show your public key with the following command:

- **gpg --armor --export 42653CC58CD62E74**
- **NOTE:** Use your own key after **--export** part

4. Copy your GPG key, beginning with:

- **-----BEGIN PGP PUBLIC KEY BLOCK -----**

And ending with:

- **-----END PGP PUBLIC KEY BLOCK -----**

#### Adding your key to GitHub

1. Go to your **settings**
2. In the settings sidebar, go to **SSH and GPG keys**
3. Click on **New GPG key**
4. In the **‘Key’** field, paste copied **public**  **key**
5. Finish with clicking on **Add GPG key** and confirm your password ( **GitHub account** password, not the passphrase)

NOTE: Check if the **Key ID on GitHub** is the same one as the **Key ID** you copied earlier:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1637697352308/DSqStZd7B.png)

If it’s not, you did something wrong. If you need help, don’t hesitate to comment down below!

#### Configuring Git on your local machine

We will modify the .gitconfig file, so this will work for any instance for Git on your windows machine.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1637697353788/wTiysytlX.png)

The global scope will suffice in this case, navigate and open the .gitconfig file with any editor (I am using Notepad++).

- NOTE: If you don't see the .gitconfig file, you probably have to enable showing hidden files on Windows (I am using Windows 11):

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1637697355263/DJWqaej_vD.png)

1. Add Key ID from before:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1637697356818/h2X-5bAu5.png)

2. Add the GPG section which will point to gpg binary you used for generating a key:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1637697358231/wuKdwPVkC.png)

- **NOTE: I had problems with only ‘gpg’ or single back-slashes. The method from the picture should work on every Windows 11 machine.**

3. Add commit section which will tell git to sign every commit:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1637697359568/T-gS4m8iQ.png)

**That’s it! Now you are able to push signed commits!**

### Vigilant Mode

If you want to go further, this option will mark every commit you **didn't sign** as **Unverified**.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1637697360962/zoLEd85PF.png)

**Thank you for reading!**

**_\_ktb_**