Signing Commits and Tags with GPG
Learn how to cryptographically sign your commits and tags so others can verify they truly came from you.
Signing Commits and Tags with GPG is a free DevOps Bootcamp lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Sign Commits?
Git records an author name and email, but anyone can set those to any value. Signing proves a commit really came from you using cryptography.
How Signing Works
You hold a private key. Git attaches a signature created with that key. Others verify it with your public key, confirming authenticity and integrity.
Generating a GPG Key
Create a key pair with GPG. The private key stays secret; the public key is shared.
gpg --full-generate-keyFinding Your Key ID
List your secret keys to get the long key ID you will tell Git to use.
gpg --list-secret-keys --keyid-format=longTelling Git Your Key
Set the signing key in your Git config.
git config --global user.signingkey 3AB12CD34EF56789Signing a Single Commit
Add the -S flag to sign one commit.
git commit -S -m 'Add secure endpoint'Signing Every Commit
Enable automatic signing so you never forget.
git config --global commit.gpgsign trueSigning Tags
Annotated tags can also be signed, which is important for verified releases.
git tag -s v1.0.0 -m 'Signed release'Verifying Signatures
Anyone with your public key can verify a commit or tag signature.
git verify-commit HEAD
git verify-tag v1.0.0Showing Signatures in Log
View signature status alongside the commit log.
git log --show-signature -1Verified Badge on GitHub
After you upload your public GPG key to GitHub, signed commits show a green Verified badge, building trust in your contributions.
Quick Check
Test your understanding of signing commits.
Recap
You learned to sign commits and tags:
- Generate a GPG key and register it with Git
-Ssigns a commit,commit.gpgsign trueautomates itgit tag -ssigns release tags- Uploading your public key shows a Verified badge on GitHub
Frequently asked questions
Is the “Signing Commits and Tags with GPG” lesson free?
Yes — the full text of “Signing Commits and Tags with GPG” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.
What will I learn in “Signing Commits and Tags with GPG”?
Learn how to cryptographically sign your commits and tags so others can verify they truly came from you. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start DevOps Bootcamp?
No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Signing Commits and Tags with GPG” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this DevOps Bootcamp lesson?
Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Securing Your Git Workflow
- Handling Sensitive Data (Git LFS)
- Best Practices for Commit Messages
- Signing Commits and Tags with GPG