glossary

GPG Signing

A cryptographic method to sign git commits and tags with a GPG key, verifying the identity of the author and ensuring the commit content has not been tampered with.

explanation

GPG (GNU Privacy Guard) signing gives git commits a cryptographic seal of authenticity. When you sign a commit, git creates a digital signature using your private GPG key and attaches it to the commit object. Others can verify the signature using your public key, confirming that the commit was made by you and has not been altered since signing. Git supports two signing mechanisms: GPG (the default) and SSH (via git config gpg.format ssh, available since Git 2.34). Both serve the same purpose. GPG is the more established option, while SSH signing uses the same keys you already use for SSH authentication, simplifying key management. To sign commits, you need a GPG key pair, and you must configure git with your signing key (git config --global user.signingkey <key-id>). Then git commit -S signs the commit, or git config --global commit.gpgsign true makes signing automatic. On GitHub, verified commits display a "Verified" badge next to the commit, and repository settings can require signed commits for protected branches.

examples

git commit -S -m 'feat(auth): add OAuth2 PKCE flow' # sign a single commit

git config --global commit.gpgsign true # auto-sign all commits

git config --global user.signingkey ABCDEF1234567890 # set signing key

git tag -s v1.0.0 -m 'v1.0.0 stable release' # sign a tag

git log --show-signature # verify signatures in commit log

how git-agent helps

git-agent respects your git configuration. If you have commit.gpgsign set to true, every commit git-agent creates is automatically signed. The generated commit messages contain the context you need for meaningful signed commits, making your signed history informative and verifiable.

brew install gitagenthq/brew/git-agent

FAQ

Do I need a GPG key to sign commits?

Yes. You need a GPG key pair (or an SSH key if using SSH signing). Generate one with gpg --full-generate-key, then add the public key to your GitHub/GitLab account and configure git with your signing key.

Does git-agent create signed commits automatically?

git-agent runs git commit internally. If you have commit.gpgsign = true in your git config, the commit will be signed automatically. git-agent does not add or remove signing — it respects your existing git configuration.

What is the difference between GPG signing and SSH signing?

Both produce verified commits. GPG is the traditional approach with its own key infrastructure. SSH signing uses the same keys you already use for SSH — no separate key management. SSH signing is simpler but requires Git 2.34+ and is less universally supported by older tools.

Conventional Commits Commit message format Pre-commit hooks