DEV Community

Joseph D. Marhee
Joseph D. Marhee

Posted on

Signing Existing Commits with GPG

Signing commits is a longstanding practice, especially around tags (releases) for your projects, however, sometimes this must be done retroactively, especially if you hadn't been signing your commits/releases previously and don't wish to cut a new release simply to append your signature.

Getting your gitconfig setup for GPG signed commits is pretty straight forward. Get your key fingerprint from the output of gpg -k and you'll see an output like this:

/Users/jmarhee/.gnupg/pubring.kbx
--------------------------------------
pub   rsa2048 2020-06-15 [SC] [expires: 2022-06-15]
      <fingerprint>
uid           [ultimate] Joseph D. Marhee <email>
sub   rsa2048 2020-06-15 [E] [expires: 2022-06-15]
Enter fullscreen mode Exit fullscreen mode

You'll then add it to your Git configuration so Git knows which key to sign your commits with:

git config --global user.signingkey <your Key ID>
Enter fullscreen mode Exit fullscreen mode

and if you want to do this automatically on each commit, you'll also run:

git config commit.gpgsign true
Enter fullscreen mode Exit fullscreen mode

and:

export GPG_TTY=$(tty)
Enter fullscreen mode Exit fullscreen mode

and you're ready to modify your commits.

You'll start an interactive rebase:

git rebase -i --root
Enter fullscreen mode Exit fullscreen mode

scroll until you find your commit in the pick list, then modify the keyword pick to read edit:

edit <commit>
Enter fullscreen mode Exit fullscreen mode

save, and then amend your commit to include the signature, and complete the rebase:

git commit -S --amend --no-edit 
git rebase --continue
Enter fullscreen mode Exit fullscreen mode

and then push to your branch. One thing to keep in mind is that you sign using the same email address you're committing with (the one you provided when you generated your GPG key); this must match, for example, in order for sites like Github to mark the signature verified. You can update the commit (without updating your Git configuration default email address) using:

git commit --amend --author "Your Name <you@domain.com>"
Enter fullscreen mode Exit fullscreen mode

or setting this in your config to persist this for future commits:

git config --global user.email "you@domain.com"
Enter fullscreen mode Exit fullscreen mode

and push.

Discussion (0)