Sign your commits with your SSH key

Verified badges on GitHub without setting up GPG.

SNP 059 #64B Filed 8 months ago git ssh

You already have an SSH key, so use it for signing too:

shell

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

Then add the same public key to GitHub (or Bitbucket, GitLab) as a signing key, not just an authentication key. New commits show up as Verified.

To verify signatures locally git needs a list of allowed signers:

shell

echo "[email protected] $(cat ~/.ssh/id_ed25519.pub)" >> ~/.ssh/allowed_signers
git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers
git log --show-signature -1