Verified Commits on GitHub from Ubuntu 22.04 LTS (GPG Keys) ✅

In this blog, I’ll walk you through setting up GPG keys on Ubuntu 22.04 LTS to sign Git commits, ensuring they appear as verified on GitHub. Verified commits add a layer of trust to your contributions, making it clear that your commits are authentic. Let’s get started!

Table of Contents

1. Introduction to Signed Commits


2. Verified Commits vs. Unverified Commits on GitHub


3. Installing GPG on Ubuntu 22.04 LTS


4. Generating a GPG Key and Configuring GitHub


5. Configuring Git on Ubuntu to Sign Commits


6. Creating Signed Commits

1. Introduction to Signed Commits

Signed commits use GPG keys to verify the identity of the commit author, ensuring that the changes come from a trusted source. GitHub displays these verified commits with a green badge, signaling authenticity and providing security. We’ll begin by understanding how signed commits work and why they’re valuable.

2. Verified Commits vs. Unverified Commits on GitHub

GitHub marks verified commits with a green checkmark, while unverified commits lack this indicator. Verified commits help the community trust that the code truly comes from you, as opposed to an unverified commit that could potentially be from an unknown source.

Verified Commit(Singed Commit)

3. Installing GPG on Ubuntu 22.04 LTS

To create signed commits, we’ll first need to install GPG if it’s not already available.

• 
  Update Your System:
  

   sudo apt update && sudo apt upgrade

• 
  Install GPG:
  

   sudo apt install gnupg

After installation, verify GPG is set up by running:

   gpg --version

4. Generating a GPG Key and Configuring GitHub

With GPG installed, let’s generate a GPG key to use for signing our commits.

• 
  Generate GPG Key:
  

   gpg --full-generate-key

Follow the prompts to create a new GPG key.

• 
  List GPG Key with Key IDs:
  

   gpg --list-secret-keys --keyid-format LONG

• Click New GPG Key and paste your public key.

5. Configuring Git on Ubuntu to Sign Commits

After adding the GPG key to GitHub, configure Git on Ubuntu to use this key for signing commits.

• 
  Configure Git with Your GPG Key:
  

   git config --global user.name "YOUR-NAME"

   git config --global user.email "YOUR-EMAIL"

   git config --global user.signingkey YOUR-KEY-ID

   git config --global commit.gpgsign true

   git config --global tag.gpgsign true

• 
  You'll get the path
  

which gpg 

or 

where gpg

git config --gloal tag.program "path"

• 
  List Global Git Configuration (Optional):
  

   git config --global --list

This step verifies that all settings are configured properly.

6. Creating Signed Commits

With everything set up, you’re ready to create signed commits that will be marked as verified on GitHub.

Making a Signed Commit:

git commit -S -m "Your commit message"

• The -S flag ensures the commit is signed.

Since we configured Git to sign all commits globally, you can also commit without the -S flag:

git commit -m "Your commit message"

After pushing the commit, it will automatically be signed, and you should see a “Verified” badge on GitHub.

Thanks for reading Engineers!