Signed Commits

ELI5 - The Vibe Check

Signed commits are git's way of proving a commit actually came from the person whose name is on it, not from someone who cloned your repo and set git config user.name to your name, which anyone can do in about five seconds. You sign each commit with a GPG or SSH key, and platforms like GitHub show a small verified badge next to the ones that check out.

Real Talk

Signed commits use GPG or SSH keys to cryptographically sign commit objects via git commit -S, allowing platforms like GitHub and GitLab to verify that a commit was created by the holder of the associated private key, rather than merely attributed to that identity through the freely editable user.name and user.email git config fields. They're increasingly required in supply chain sensitive projects and regulated environments, since unsigned commits offer no protection against author spoofing.

Show Me The Code

$ git config --global commit.gpgsign true
$ git config --global user.signingkey <KEY_ID>
$ git commit -S -m "fix: patch known vulnerability in dependency"

When You'll Hear This

"We require signed commits on main now, spoofed authorship was too easy otherwise." / "GitHub shows Verified next to signed commits, unverified next to everything else."