{"id":20849425,"url":"https://github.com/wizcorp/git-signed","last_synced_at":"2025-07-08T05:40:12.302Z","repository":{"id":141085016,"uuid":"88706835","full_name":"Wizcorp/git-signed","owner":"Wizcorp","description":"Signing commits made easy","archived":false,"fork":false,"pushed_at":"2018-10-02T08:15:20.000Z","size":276,"stargazers_count":8,"open_issues_count":3,"forks_count":3,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-06-13T08:51:46.668Z","etag":null,"topics":["git","gpg","gpg-key","gpgme","javascript","nodejs","signing"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Wizcorp.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2017-04-19T06:00:37.000Z","updated_at":"2023-08-25T09:09:46.000Z","dependencies_parsed_at":"2023-03-19T18:21:34.500Z","dependency_job_id":null,"html_url":"https://github.com/Wizcorp/git-signed","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/Wizcorp/git-signed","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Wizcorp%2Fgit-signed","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Wizcorp%2Fgit-signed/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Wizcorp%2Fgit-signed/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Wizcorp%2Fgit-signed/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Wizcorp","download_url":"https://codeload.github.com/Wizcorp/git-signed/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Wizcorp%2Fgit-signed/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264202716,"owners_count":23572206,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["git","gpg","gpg-key","gpgme","javascript","nodejs","signing"],"created_at":"2024-11-18T03:04:54.071Z","updated_at":"2025-07-08T05:40:12.297Z","avatar_url":"https://github.com/Wizcorp.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Logo](./images/logo.png)\n\n[![GitHub tag](https://img.shields.io/github/tag/Wizcorp/git-signed.svg?style=flat-square)](https://github.com/Wizcorp/git-signed/releases/latest)\n[![npm](https://img.shields.io/npm/v/git-signed.svg?style=flat-square)](https://www.npmjs.com/package/git-signed)\n[![npm](https://img.shields.io/npm/dt/git-signed.svg?style=flat-square)](https://www.npmjs.com/package/git-signed)\n\nWhy?\n----\n\nSigning your commits ensure:\n\n  1. That your commits cannot be re-edited by someone else (using git commit --amend)\n  2. That no one cant impersonate you and try to add commits to a codebase\n\nHowever, getting started with commit signing is often a tedious process. Many developers\nstill do not sign their commits despite both GitHub and GitLab promoting its use. \n\nAlso, without having imported the public key of collaborators on the project, you\nwill not be able to confirm that their commits are indeed signed. This means that locally\n(either during development or on a CI server), you will likely not have a straightforward\nway to verify and ensure that all commits in your repository are indeed signed.\n\ngit-signed solves both problems by providing a workflow for creating, \npublishing, and locally syncing GPG keys. It also configures \nthe local repository to automatically sign all commits with the selected\nkey.\n\nRequirements\n------------\n\nYou will need `gpgme` installed locally on your machine.\n\n  - Arch Linux: `pacman -S gpgme` or `yaourt -S gpgme`\n  - Ubuntu: `apt-get install gpgme`\n  - macOS: `brew install gpgme`\n\nWindows users do not need to install gpgme, we will be using\nthe copy of gnupg that is installed alongside `git`.\n\nInstallation\n------------\n\n```shell\nnpm install --save-dev git-signed\n```\n\nUsage\n-----\n\n[![Tutorial](./images/screenshot.png)](https://asciinema.org/a/149115)\n\n[Click here to see our tutorial](https://asciinema.org/a/149115)\n\nIn `package.json`:\n\n```json\n{\n  \"scripts\": {\n    \"collaborator:join\": \"git-signed --join\",\n    \"collaborator:export-key\": \"git-signed --export\",\n    \"collaborator:sync-keys\": \"git-signed --sync\",\n    \"test:commit-signatures\": \"git-signed\"\n  }\n}\n```\n\nThen, add yourself as a collaborator. This will add a `collaborators` entry\nin you `package.json` file that will be augmented with information about\nhow to fetch your key.\n\n```shell\nnpm run collaborator:join\n```\n\nOn GitHub and GitLab PRs, signed commit will have a \"verified\" badge attached to them.\n\n![verified badge](./images/verified.png)\n\nTo add your GPG key to GitHub, GitLab, or other systems, export your key.\n\n```shell\nnpm run collaborator:export-key\n```\n\nAs collaborators join the project, more `collaborators` entries will be added\nto your `package.json`. You will need to fetch their keys so to see their \ncommits as properly signed.\n\n```shell\nnpm run collaborator:sync-keys\n```\n\nOnce you have synced the keys to your localk keyring, you can now\ntest that all commits are indeed signed.\n\n```shell\ntest:commit-signatures\n```\n\nIn some cases, you will want to start checking for signed\ncommits only from a certain point in history (for instance, if all previous\ncommits on the project were not signed until this point). Adding a commit\nshort hash to the `git-signed` command will ignore all previous commits\nin your commit tree.\n\n```json\n{\n  \"scripts\": {\n    \"test:commit-signatures\": \"git-signed 86ce8bc\"\n  }\n}\n```\n\nFinally, note that `git-signed` will only scan commits in the current branch.\nTo scan another branch, simply switch to it, and run git-signed again.\n\nIntegrating with Husky\n----------------------\n\nHusky allows for the automated setup of commit hooks. One common use\nof git-signed is to add a post-commit test to let developers know that they\nneed to sign their work.\n\n```json\n{\n  \"scripts\": {\n    \"precommit\": \"npm run test\",\n    \"postcommit\": \"npm run test:commit-signatures\",\n    \"postmerge\": \"npm install \u0026\u0026 npm run collaborator:sync-keys\",\n    \"update\": \"npm install \u0026\u0026 npm run collaborator:sync-keys\"\n  }\n}\n```\n\nYou may find a more complete example in the [package.json](./package.json) file\nof this project.\n\nRepository configuration\n------------------------\n\n![repo settings](./images/repo-settings.png)\n\nIf you are using GitHub or GitLab, you will need to disable `Allow squash commit` \nand `Allow rebase commit`; this is due to the fact that signed commits would eithet\nbe squashed into an unsigned one, or simply get unsigned.\n\nLicense\n-------\n\nMIT.\n\nAcknowledgements\n----------------\n\nGit graphic by \u003ca href=\"https://thenounproject.com/sergey.novosyolov\"\u003etnp_sergey_novosyolov\u003c/a\u003e from \u003ca href=\"https://thenounproject.com/\"\u003eTheNounProject\u003c/a\u003e is licensed under \u003ca href=\"http://creativecommons.org/licenses/by/3.0/\" title=\"Creative Commons BY 3.0\"\u003eCC BY 3.0\u003c/a\u003e. Check out the new logo that I created on \u003ca href=\"https://logomakr.com/1D6HDT\" title=\"Logo Maker\"\u003eLogoMaker.com\u003c/a\u003e https://logomakr.com/1D6HDT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwizcorp%2Fgit-signed","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwizcorp%2Fgit-signed","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwizcorp%2Fgit-signed/lists"}