DEV Community

Cover image for How to Set Up SSH & GPG Signed Commits on GitHub to Block Force-Push Attacks
Ankush Lokhande
Ankush Lokhande

Posted on

How to Set Up SSH & GPG Signed Commits on GitHub to Block Force-Push Attacks

#github #development #developer #learning

👋 Hey all,
Welcome back to our blog!

Here's a scary thought:

Someone force-pushes to main.
Git history gets rewritten.
A malicious commit appears in the branch.

Nobody notices that the commit wasn't created by the developer it claims to be from.

This isn't just a theoretical risk. Misconfigured repositories, compromised accounts, and unverified commits can make it difficult to trust the history of your codebase.

Today, we're setting up two important layers of Git security that many developers overlook: SSH authentication and GPG commit signing.

Together, they help ensure:

✅ Only authorized machines can authenticate with GitHub using your SSH key
✅ Every commit is cryptographically signed and can be verified
✅ Rewritten history and suspicious commits become much easier to detect
✅ GitHub displays a Verified badge for authentic signed commits

Let's Begin

In this guide, we'll walk through the complete setup on macOS — from installing GitHub CLI and configuring SSH access to generating a GPG key and signing every commit you create.

Let's lock down our Git workflow. 🔐

Prerequisites

  • Mac with Homebrew installed
  • GitHub account
  • Terminal access

Setup Prerequisites

Configure SSH Authentication & GPG Signed Commits on GitHub

SSH authentication secures access to your GitHub repositories, while GPG signing verifies the authenticity of every commit you create. Together, they help protect your codebase and build trust in your Git history.

Start Coding

Step 1 — Install GitHub CLI

Run command to download gh:

brew install gh
Enter fullscreen mode Exit fullscreen mode

gh is GitHub's official command-line tool. It allows you to authenticate with GitHub, generate SSH keys, and manage repositories directly from your terminal.

Step 2 — SSH Setup

Run:

gh auth login
Enter fullscreen mode Exit fullscreen mode

Answer the following:

? Where do you use GitHub?
  GitHub.com
? What is your preferred protocol for Git operations on this host?
  SSH
? Generate a new SSH key to add to your GitHub account?
  Yes
? Enter a passphrase for your new SSH key (Optional)
  ********
? Title for your SSH key
  title_for_ssh_key // eg. organization_name
? How would you like to authenticate GitHub CLI?
  Login with a web browser
Enter fullscreen mode Exit fullscreen mode

GitHub CLI will then display a one-time code:

! First copy your one-time code: XXXX-XXXX
Press Enter to open https://github.com/login/device in your browser...
Enter fullscreen mode Exit fullscreen mode

Press Enter, open the provided URL, sign in to your GitHub account, and enter the one-time code when prompted.

After successful authentication, you'll see output similar to:

✓ Authentication complete.
✓ Configured git protocol
✓ Uploaded the SSH key to your GitHub account
✓ Logged in as your-username
Enter fullscreen mode Exit fullscreen mode

This step automatically generates a new SSH key, uploads it to your GitHub account, and configures Git to use SSH for repository operations.

Step 3 — Install GnuPG

Run the following command:

brew install gnupg
Enter fullscreen mode Exit fullscreen mode

Verify the installation:

gpg --version
Enter fullscreen mode Exit fullscreen mode

GnuPG (GPG) is used to generate cryptographic keys that digitally sign your commits. GitHub uses these signatures to verify that a commit was created by you and has not been modified since it was signed.

Step 4 — Generate a GPG Key

Run:

gpg --full-generate-key
Enter fullscreen mode Exit fullscreen mode

Select the following options:

Please select what kind of key you want:
(1) RSA and RSA

RSA keys may be between 1024 and 4096 bits long.
What keysize do you want?
4096

Please specify how long the key should be valid.
0 = key does not expire

Real name:
Your Name

Email address:
your-email@example.com
Enter fullscreen mode Exit fullscreen mode

Review the information and confirm the key creation.

You'll then be prompted to create a passphrase for your key.

Choose a strong passphrase and store it securely. This passphrase protects your private GPG key and will be required when signing commits.

Step 5 — Find Your GPG Key ID

Run:

gpg --list-secret-keys --keyid-format LONG
Enter fullscreen mode Exit fullscreen mode

Example output:

sec   rsa4096/ABC123DEF4567890 2026-06-01 [SC]
      1234567890ABCDEF1234567890ABCDEF12345678
uid                 [ultimate] Your Name <your-email@example.com>
Enter fullscreen mode Exit fullscreen mode

Copy the value after rsa4096/:

ABC123DEF4567890
Enter fullscreen mode Exit fullscreen mode

This is your GPG Key ID. You'll use it to export your public key and configure Git commit signing.

Step 6 — Export Your Public GPG Key

Replace <KEY_ID> with the key ID copied in the previous step:

gpg --armor --export <KEY_ID>
Enter fullscreen mode Exit fullscreen mode

Example:

gpg --armor --export ABC123DEF4567890
Enter fullscreen mode Exit fullscreen mode

You'll see output similar to:

-----BEGIN PGP PUBLIC KEY BLOCK-----
...
-----END PGP PUBLIC KEY BLOCK-----
Enter fullscreen mode Exit fullscreen mode

Copy the entire block, including the BEGIN and END lines.

This is your public GPG key. GitHub uses it to verify commits signed with your private key.

Step 7 — Add Your GPG Key to GitHub

Open GitHub and navigate to:

Profile Picture → Settings → SSH and GPG Keys
Enter fullscreen mode Exit fullscreen mode

Click:

New GPG Key
Enter fullscreen mode Exit fullscreen mode

Paste the public key copied in the previous step:

-----BEGIN PGP PUBLIC KEY BLOCK-----
...
-----END PGP PUBLIC KEY BLOCK-----
Enter fullscreen mode Exit fullscreen mode

Then click Add GPG Key.

Once added, GitHub can verify commits signed with your private GPG key and display the Verified badge on your commits.

Step 8 — Configure Git to Sign Commits

Replace <KEY_ID> with your GPG Key ID and run:

git config --global user.signingkey <KEY_ID>
git config --global commit.gpgsign true
git config --global gpg.program gpg
Enter fullscreen mode Exit fullscreen mode

Example:

git config --global user.signingkey ABC123DEF4567890
git config --global commit.gpgsign true
git config --global gpg.program gpg
Enter fullscreen mode Exit fullscreen mode

These settings tell Git which GPG key to use and automatically sign every commit you create.

Step 9 — Configure GPG Terminal Support

Run:

echo 'export GPG_TTY=$(tty)' >> ~/.zshrc
source ~/.zshrc
Enter fullscreen mode Exit fullscreen mode

This allows GPG to interact correctly with your terminal when requesting your passphrase during commit signing.

Step 10 — Verify Commit Signing

Create a signed commit:

git commit -S -m "Test signed commit"
Enter fullscreen mode Exit fullscreen mode

If prompted, enter the passphrase you created when generating your GPG key.

Push the commit to GitHub:

git push
Enter fullscreen mode Exit fullscreen mode

Open the commit on GitHub. You should see a Verified badge next to the commit.

Verified Commit Example

The Verified badge confirms that GitHub successfully validated the GPG signature attached to your commit.

Step 11 — Protect Your Main Branch

For maximum security, enable branch protection rules on your repository.

Navigate to:

Repository → Settings → Branches
Enter fullscreen mode Exit fullscreen mode

Edit your branch protection rule and enable:

✓ Require signed commits
✓ Block force pushes
✓ Require pull request reviews
✓ Require status checks before merging
Enter fullscreen mode Exit fullscreen mode

These protections help ensure that only verified, reviewed, and trusted code can be merged into your main branch.

Let's Wrap!

SSH authentication protects repository access, while GPG signing verifies commit authenticity. Together, they provide a stronger security foundation for your Git workflow and make suspicious or rewritten commits much easier to identify. 🔐

One correction: GitHub doesn't literally have a setting called "Block force pushes" everywhere. Depending on the repository type, you'll typically see "Allow force pushes" (leave disabled) or "Restrict who can force push". So for accuracy, you may want to write:

✓ Require signed commits
✓ Disable force pushes
✓ Require pull request reviews
✓ Require status checks before merging

which is easier for readers to understand.

Thanks for reading

If you found this blog helpful or have any further questions, we would love to hear from you. Feel free to reach out and follow us on our social media platforms for more tips and tutorials on tech-oriented posts.

Happy coding!👨‍💻

Top comments (0)