Git Verifying Commits – Git


Git Verifying Commits

When you’re building software with people from around the world, sometimes it’s important to validate that commits and tags are coming from an identified source. Git supports signing commits and tags with GPG. GitHub shows when commits and tags are signed.

Verified Commits

When you view a signed commit or tag, you will see a badge indicating if the signature could be verified using any of the contributor’s GPG keys uploaded to GitHub. You can upload your GPG keys by visiting the keys settings page.

Many open source projects and companies want to be sure that a commit is from a verified source. GPG signature verification on commits and tags makes it easy to see when a commit or tag is signed by a verified key that GitHub knows about.

Verified Signature

More Information:

This article needs improvement. You can help improve this article. You can also write similar articles and help the community.