DEV Community

Discussion on: How to Use GPG to Sign your Commits on Github, Gitlab, Bitbucket

Collapse
 
sandordargo profile image
Sandor Dargo

Thanks for the article. You wrote that you don't recommend to sign all the commits. What do you recommend? Which commits would you sign and why?

Collapse
 
shostarsson profile image
Rémi Lavedrine • Edited

I do not recommend to sign all of your commit on your global configuration because if you don't have a GPG key properly configured for a service that you are going to use you are going to encounter some problem.
Similarly if you are using a software to manage your git (like Gitkraken for instance), if you have a Global configuration that force signing all commits, you can have some problem.
That is why I think that you should force signing commit on a repo from repo strategy.

I hope that helps.