A commit’s author line is a text field anyone can set. Signing replaces “trust the name” with “trust the key”. Whether your team needs that depends on what the repo protects.
The cheap version: sign with your SSH key#
No GPG setup anymore — git signs with the SSH key you already push with:
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
Add the same public key to your git host as a signing key and your commits show as verified.
When it earns the setup#
- Repos whose history feeds audits or compliance, where “who actually wrote this” needs an answer.
- Open source or vendor code others build on, where a forged author line is a real supply-chain risk.
- Teams with contractors coming and going, where key rotation is easier to reason about than usernames.
When to skip it#
A private repo for a two-person team that reviews everything anyway gains little. Signing proves authorship of the commit, not quality of the code — review is still the control that matters.
If you adopt it#
Turn on the host’s “require signed commits” only after everyone signs comfortably. Flipping it early just teaches people to bypass the rule.
Share this post
Keep reading
Annotating Commits with git notes: Metadata Without Rewriting History
Some things belong on a commit but not in it: review links, benchmark results, the ticket nobody remembered to reference. git notes adds them after the fact, no rebase required.
Backing Up Your Git Server So It Actually Restores
Every clone is a partial backup - but hooks, config and server state live outside the repo. Mirror, bundle, copy off-site, and rehearse the restore.
Cherry-Picking: One Commit Without the Branch
Cherry-pick copies a single commit onto your branch and leaves the rest behind. Right for hotfixes across release branches, wrong as a sync strategy.
