https://github.com/jxareas/sign-with-gpg
Learn how to easily sign your commits with GPG Cryptographic Keys on MacOS & Windows.
https://github.com/jxareas/sign-with-gpg
commit-signing cryptography git gpg learn macos windows
Last synced: 7 months ago
JSON representation
Learn how to easily sign your commits with GPG Cryptographic Keys on MacOS & Windows.
- Host: GitHub
- URL: https://github.com/jxareas/sign-with-gpg
- Owner: jxareas
- License: cc0-1.0
- Created: 2022-12-19T23:47:34.000Z (almost 3 years ago)
- Default Branch: master
- Last Pushed: 2023-04-11T05:38:31.000Z (over 2 years ago)
- Last Synced: 2025-01-20T23:47:05.818Z (9 months ago)
- Topics: commit-signing, cryptography, git, gpg, learn, macos, windows
- Homepage:
- Size: 11.7 KB
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Sign your Commits with GPG
This repository provides simple intructions on how to sign your Git commits locally using GPG, in both [MacOS](./macos/README.md) and [Windows](./windows/README.md) Environments.
## Why use GPG signatures?
Commit signature verification allows you to sign commits and tags locally, to give other people confidence about the origin of a change you have made. If a commit or tag has a GPG, SSH, or S/MIME signature that is cryptographically verifiable, GitHub marks the commit or tag "Verified" or "Partially verified."
For most individual users, GPG or SSH will be the best choice for signing commits. S/MIME signatures are usually required in the context of a larger organization. SSH signatures are the simplest to generate. You can even upload your existing authentication key to GitHub to also use as a signing key. Generating a GPG signing key is more involved than generating an SSH key, but GPG has features that SSH does not.
A GPG key can expire or be revoked when no longer used. GitHub shows commits that were signed with such a key as "Verified" unless the key was marked as compromised. SSH keys don't have this capability.