Signing GitHub commits with GPG

gistfile1.md

Signing GitHub commits with GPG

Setup (macOS + GPG)

1. Get your key ID (if you don't have a key yet, create one with gpg --full-generate-key)

gpg --list-secret-keys --keyid-format=long
# sec ed25519/3AA5C34371567BD2  <- this is the ID

2. Match the key email to your git email

git config user.email

This address must be in the key's uid and verified on GitHub (Settings → Emails). If it's missing, add it:

gpg --edit-key <ID>
gpg> adduid
gpg> save

3. Add the key to GitHub

gpg --armor --export <ID>

Paste the output in Settings → SSH and GPG keys → New GPG key. If you changed UIDs, delete the old entry first.

4. Enable signing in git

git config --global user.signingkey <ID>
git config --global commit.gpgsign true
git config --global tag.gpgsign true

5. Enter the passphrase once (macOS Keychain)

brew install pinentry-mac
cat > ~/.gnupg/gpg-agent.conf <<EOF
pinentry-program $(brew --prefix)/bin/pinentry-mac
default-cache-ttl 28800
max-cache-ttl 86400
EOF
gpgconf --kill gpg-agent

On the first signature, tick Save in Keychain.

6. Test

git commit --allow-empty -m "test signing"
git log --show-signature -1   # expect: Good signature from ...

After you push, the commit should show a green Verified badge.

7. Vigilant mode

Settings → SSH and GPG keys → ✅ Flag unsigned commits as unverified.

Good to know

• Key B5690EEEBB952194 belongs to GitHub (web-flow). GitHub uses it to sign PR merges and squashes, edits made in the browser, and commits created through the API. It won't appear in your key list, and that's expected.
• If you prefer SSH signing, set gpg.format ssh and add the key on GitHub as a Signing Key. A key added only as an Authentication Key won't count for signatures.
• When you use a noreply email, use the form that includes your numeric ID (12345+login@users.noreply.github.com), not just login@....