How do you sign your commits with GPG in Git, and why is it important? — Git Interview Question #33

In Git, signing your commits with GPG (GNU Privacy Guard) is a way to verify the authenticity of your commits. By signing your commits with GPG, you can provide assurance that the commit was made by you and has not been tampered with.

Here’s how to sign your commits with GPG:

Install GPG on your computer if you haven’t already done so.

Generate a GPG key:

    # Generate a GPG key
    gpg --gen-key

Configure Git to use your GPG key:

    # Configure Git to use your GPG key
    git config --global user.signingkey <key-id>

In this command, <key-id> is the ID of your GPG key. You can find the ID of your key using the gpg –list-keys command.

Commit your changes as usual:

    # Commit your changes
    git commit -m "Your commit message"

Use the -S or –gpg-sign option to sign your commit with GPG:

    # Sign your commit with GPG
    git commit -S -m "Your commit message"

In this command, the -S or –gpg-sign option tells Git to sign your commit with GPG.

Push your changes to the remote repository:

    # Push your changes to the remote repository
    git push

In summary, signing your commits with GPG in Git is a way to verify the authenticity of your commits. To sign your commits with GPG, you must first generate a GPG key and configure Git to use your key. After configuring Git, you can sign your commits with GPG using the -S or –gpg-sign option when committing your changes. It is important to sign your commits with GPG to provide assurance that the commit was made by you and has not been tampered with.