PricingLoginStart free
DevOps Bootcamp · Lesson

Signing Commits and Tags with GPG

Learn how to cryptographically sign your commits and tags so others can verify they truly came from you.

Lesson 4 of 413 steps

Signing Commits and Tags with GPG is a free DevOps Bootcamp lesson on CoddyKit. This is lesson 4 of 4. Any 3 lessons of this learning path are free to read in full — after that, CoddyKit PRO unlocks every lesson, plus hands-on practice with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, and your progress syncs across the web and the CoddyKit app. The DevOps Bootcamp course includes 4 lessons in total.

Why Sign Commits?

Git records an author name and email, but anyone can set those to any value. Signing proves a commit really came from you using cryptography.

How Signing Works

You hold a private key. Git attaches a signature created with that key. Others verify it with your public key, confirming authenticity and integrity.

Generating a GPG Key

Create a key pair with GPG. The private key stays secret; the public key is shared.

gpg --full-generate-key

Finding Your Key ID

List your secret keys to get the long key ID you will tell Git to use.

gpg --list-secret-keys --keyid-format=long

Telling Git Your Key

Set the signing key in your Git config.

git config --global user.signingkey 3AB12CD34EF56789

Signing a Single Commit

Add the -S flag to sign one commit.

git commit -S -m 'Add secure endpoint'

Signing Every Commit

Enable automatic signing so you never forget.

git config --global commit.gpgsign true

Signing Tags

Annotated tags can also be signed, which is important for verified releases.

git tag -s v1.0.0 -m 'Signed release'

Verifying Signatures

Anyone with your public key can verify a commit or tag signature.

git verify-commit HEAD
git verify-tag v1.0.0

Showing Signatures in Log

View signature status alongside the commit log.

git log --show-signature -1

Verified Badge on GitHub

After you upload your public GPG key to GitHub, signed commits show a green Verified badge, building trust in your contributions.

Quick Check

Test your understanding of signing commits.

Answer it in the interactive lesson

Recap

You learned to sign commits and tags:

  • Generate a GPG key and register it with Git
  • -S signs a commit, commit.gpgsign true automates it
  • git tag -s signs release tags
  • Uploading your public key shows a Verified badge on GitHub
Free to start

Learn DevOps Bootcamp with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses
142
Lessons
568
Start learning freeView the full course

Frequently Asked Questions

Is the “Signing Commits and Tags with GPG” lesson free?

Yes — any 3 lessons of the DevOps Bootcamp learning path, including “Signing Commits and Tags with GPG”, are free to read in full here on the web. After that, CoddyKit PRO unlocks every lesson, plus interactive practice with a built-in code editor and a 24/7 AI tutor. The DevOps Bootcamp course includes 4 lessons in total.

What will I learn in “Signing Commits and Tags with GPG”?

Learn how to cryptographically sign your commits and tags so others can verify they truly came from you. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.

How long does the “Signing Commits and Tags with GPG” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Securing Your Git Workflow
  2. Handling Sensitive Data (Git LFS)
  3. Best Practices for Commit Messages
  4. Signing Commits and Tags with GPG
← Back to DevOps Bootcamp