git commit -S / tag -s

SafeSigned commits and tags

git commit -S -m '<msg>'

Signs commits/tags with GPG or SSH keys — the source of the 'Verified' badge and tamper-proof authorship.

Examples

git config --global gpg.format ssh && git config --global user.signingkey ~/.ssh/id_ed25519.pubSign with an SSH key
git config --global commit.gpgsign trueSign every commit automatically
git log --show-signature -1Verify the signature on the last commit
git tag -s v1.0 -m "release 1.0" git tag -v v1.0Create and verify a signed tag
git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signersNeeded to verify SSH signatures locally

Syntax

git commit -S / git tag -s / git config commit.gpgsign true

Key points

For a Verified badge on GitHub or GitLab, register the key as a signing key and make the commit email match the account.
SSH signing needs Git 2.34 or later.
Commits rewritten by rebase or --amend have to be signed again.

When it does not work

error: gpg failed to sign the data usually means GPG cannot prompt for the passphrase. Set export GPG_TTY=$(tty).

Before you run it

Adds signatures only.

Related commands

gpgEncrypt files / verify signatures
git configConfiguration
git tagTags

The same reference, with no signal at all

Every command on this site, held on your device. The app adds 632 more: 1,510 commands and 120 fix flows, searchable with no connection. Free to install, no ads (some content is a one-time purchase).

Get it free on the App Store