# Signing commits in git

URL: https://joaocosta.dev/blog/11
Published: 2022-05-10 · 1 min read

Quick PSA about signing git commits.

In GitLab and GitHub, you can now add a GPG key to your account. If you have a GPG key, the commits you sign will appear as `verified`: provides extra assurance that a commit originated from you, and not from an impersonator. It is also possible for repo owners to reject unsigned commits.

## Generate a key

Generating a key is as easy as running one of following, and answering the questions:

- `gpg --gen-key`;
- `gpg --full-gen-key` - more (advanced) options.

## Find your key

If you run `gpg --list-keys <EMAIL>`, where `<EMAIL>` is the e-mail address
you used to create the key, you'll be able to see the ID of your key. For example:

```sh
> gpg --list-keys joaocosta.work@posteo.net
pub   rsa4096 2022-05-04 [SC]
      ABCDEF9876543210FEDCBA0123456789ABCDEF12
uid           [ unknown] João Costa (Git commit signing key) <joaocosta.work@posteo.net>
```

The key ID is `ABCDEF9876543210FEDCBA0123456789ABCDEF12`

## Exporting the key

With `gpg --armor --export <ID>`, where `<ID>` is the ID of your key, you can export
your public key. Copy this to your [GitLab](https://gitlab.com/-/profile/gpg_keys)/
[GitHub](https://github.com/settings/gpg/new) account.

## Config git

You can add the following to your git config to automatically sign commits when you make
them (`<KEY-ID>` is the ID of your key):

```sh
[user]
  signingKey = <KEY-ID>
[commit]
  gpgsign = true
```

## Conclusion

Remember:

- Don't share your private key;
- If you set a password for your key, you might need to enter if every time you commit:
  - Search for `gpg caching password`.

Stay safe :P