Git Commit Signing for Supply-Chain Integrity¶

Signing commits (GPG or SSH) verifies commit authorship — critical for CI/CD pipelines enforcing git log --show-signature checks, SBOM audits, and secure monorepo gates.

GPG Signing Quick Path¶

git config --global user.signingkey $(gpg --list-secret-keys --with-keygrip | head -2 | tail -1 | awk '{print $NF}')
git commit -S -am "feat(ci): verify GPG-signed tags in deploy pipeline"

SSH Signing (Modern / Git 2.34+)¶

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git commit -S -am "feat(deploy): signed deploy commit"

Verification & CI Enforcement¶

git log --show-signature --stat -1
git verify-commit <commit-sha>

DevOps use case: enforce git log --show-signature --show-signature in release pipelines; reject unsigned tags and commits in release/* branches.