[GitHub] Add ssh signing to your git commits

Sarvsav Sharma
4 min readJun 3, 2024

It would be nice, if we sign our commits. The process involves below steps.

  • Creating ssh-keys
  • Uploading ssh-keys as signing keys to GitHub
  • Setting global parameters for git to sign every commit

And, then the pushed commits, will have a verified sign next to commits.

System information

Operating system: Ubuntu 22.04 LTS
git version 2.45.2

Step 1: Generating ssh-keys

With the help of ssh-keygen command, we can generate the public and private key pair for us. The flag -t here represents the type of algorithm that we prefer to use to generate our keys, and we have given the value as rsa.

$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/sarvsav/.ssh/id_rsa): /home/sarvsav/.ssh/id_rsa_demo
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/sarvsav/.ssh/id_rsa_demo.
Your public key has been saved in /home/sarvsav/.ssh/id_rsa_demo.pub.

The first prompt will ask for the location of storing the key pairs. For demo purpose, I have renamed the keys to id_rsa_demo and then a passphrase to unlock the private key. It will not appear on screen when you type.

Step 2: Upload the public key to GitHub as signing key

--

--

Sarvsav Sharma

Mostly writes about Go, GitHub, and DevSecOps. Interested in distributed systems. GitHub:sarvsav Maintainer:go-feature-flag/gofeatureflag-lint-action