Why Sign Your Commits?
Before learning how to sign commits, we will learn why signing your commits is important.
Commit signing offers ...
For further actions, you may consider blocking this person and/or reporting abuse
Signing commit with ssh key is more easy to setup and should be considered as the default method.
dev.to/igmrrf/adding-ssh-keys-to-y...Git: The complete guide to sign your commits with an ssh key
Christophe Colombier γ» Apr 7
GPG world comes with a lot of issues and background
Thanks. I will definitely try with ssh key. I was using GPG key and thought that GPG keys are more secure. But now I will definitely try other methods too.
You can sign your commits with your email address, the user signing key and the
-Sflag. And if you are working in a private company project, for example, you would be using a company email address, so it seems overkill to do this whole approach with GPG. It is rubbing me off a tad with sharing your GPG key with others as well, seems a bit insecure to me π€Thanks for sharing! I will defintely try other things as well. I just thought GPG is little more secure than other options. But after your suggestion, I will definitely other options as well.
I will detail with my next post. Here you rely on GitHub/GitLab.
I made some research and GPG signing seems to remain the reference in term of security because:
@imransaifi but in my article I already wrote the part about allowed_signers file inside the repository
How can the others team members see if commits are signed ??
I updated the article with the screenshot of a signed commit.
Thankyou so much for commenting Jesus.
Thanks for sharing, Imran!
You're welcome Madhu.
Lol. Indeed. I quoted a wrong one. I'll write one on dev.to if I don't find one.
I just updated the article. Thanks for commenting and letting me know.
@syeo66 @imransaifi
I took the time this weekend to write an article about ssh signing in git
Git: The complete guide to sign your commits with an ssh key
Christophe Colombier γ» Apr 7
I just updated the article with the screenshot of a signed commit. I missed that.
Thanks for letting me know.
Good guide
Thankyou Bart