👋 Hey all,
Welcome back to our blog!
Here's a scary thought:
Someone force-pushes to main.
Git history gets rewritten.
A malicious commit appears in the branch.
Nobody notices that the commit wasn't created by the developer it claims to be from.
This isn't just a theoretical risk. Misconfigured repositories, compromised accounts, and unverified commits can make it difficult to trust the history of your codebase.
Today, we're setting up two important layers of Git security that many developers overlook: SSH authentication and GPG commit signing.
Together, they help ensure:
✅ Only authorized machines can authenticate with GitHub using your SSH key
✅ Every commit is cryptographically signed and can be verified
✅ Rewritten history and suspicious commits become much easier to detect
✅ GitHub displays a Verified badge for authentic signed commits
In this guide, we'll walk through the complete setup on macOS — from installing GitHub CLI and configuring SSH access to generating a GPG key and signing every commit you create.
Let's lock down our Git workflow. 🔐
Prerequisites
- Mac with Homebrew installed
- GitHub account
- Terminal access
Configure SSH Authentication & GPG Signed Commits on GitHub
SSH authentication secures access to your GitHub repositories, while GPG signing verifies the authenticity of every commit you create. Together, they help protect your codebase and build trust in your Git history.
Step 1 — Install GitHub CLI
Run command to download gh:
brew install gh
ghis GitHub's official command-line tool. It allows you to authenticate with GitHub, generate SSH keys, and manage repositories directly from your terminal.
Step 2 — SSH Setup
Run:
gh auth login
Answer the following:
? Where do you use GitHub?
GitHub.com
? What is your preferred protocol for Git operations on this host?
SSH
? Generate a new SSH key to add to your GitHub account?
Yes
? Enter a passphrase for your new SSH key (Optional)
********
? Title for your SSH key
title_for_ssh_key // eg. organization_name
? How would you like to authenticate GitHub CLI?
Login with a web browser
GitHub CLI will then display a one-time code:
! First copy your one-time code: XXXX-XXXX
Press Enter to open https://github.com/login/device in your browser...
Press Enter, open the provided URL, sign in to your GitHub account, and enter the one-time code when prompted.
After successful authentication, you'll see output similar to:
✓ Authentication complete.
✓ Configured git protocol
✓ Uploaded the SSH key to your GitHub account
✓ Logged in as your-username
This step automatically generates a new SSH key, uploads it to your GitHub account, and configures Git to use SSH for repository operations.
Step 3 — Install GnuPG
Run the following command:
brew install gnupg
Verify the installation:
gpg --version
GnuPG (GPG) is used to generate cryptographic keys that digitally sign your commits. GitHub uses these signatures to verify that a commit was created by you and has not been modified since it was signed.
Step 4 — Generate a GPG Key
Run:
gpg --full-generate-key
Select the following options:
Please select what kind of key you want:
(1) RSA and RSA
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want?
4096
Please specify how long the key should be valid.
0 = key does not expire
Real name:
Your Name
Email address:
your-email@example.com
Review the information and confirm the key creation.
You'll then be prompted to create a passphrase for your key.
Choose a strong passphrase and store it securely. This passphrase protects your private GPG key and will be required when signing commits.
Step 5 — Find Your GPG Key ID
Run:
gpg --list-secret-keys --keyid-format LONG
Example output:
sec rsa4096/ABC123DEF4567890 2026-06-01 [SC]
1234567890ABCDEF1234567890ABCDEF12345678
uid [ultimate] Your Name <your-email@example.com>
Copy the value after rsa4096/:
ABC123DEF4567890
This is your GPG Key ID. You'll use it to export your public key and configure Git commit signing.
Step 6 — Export Your Public GPG Key
Replace <KEY_ID> with the key ID copied in the previous step:
gpg --armor --export <KEY_ID>
Example:
gpg --armor --export ABC123DEF4567890
You'll see output similar to:
-----BEGIN PGP PUBLIC KEY BLOCK-----
...
-----END PGP PUBLIC KEY BLOCK-----
Copy the entire block, including the BEGIN and END lines.
This is your public GPG key. GitHub uses it to verify commits signed with your private key.
Step 7 — Add Your GPG Key to GitHub
Open GitHub and navigate to:
Profile Picture → Settings → SSH and GPG Keys
Click:
New GPG Key
Paste the public key copied in the previous step:
-----BEGIN PGP PUBLIC KEY BLOCK-----
...
-----END PGP PUBLIC KEY BLOCK-----
Then click Add GPG Key.
Once added, GitHub can verify commits signed with your private GPG key and display the Verified badge on your commits.
Step 8 — Configure Git to Sign Commits
Replace <KEY_ID> with your GPG Key ID and run:
git config --global user.signingkey <KEY_ID>
git config --global commit.gpgsign true
git config --global gpg.program gpg
Example:
git config --global user.signingkey ABC123DEF4567890
git config --global commit.gpgsign true
git config --global gpg.program gpg
These settings tell Git which GPG key to use and automatically sign every commit you create.
Step 9 — Configure GPG Terminal Support
Run:
echo 'export GPG_TTY=$(tty)' >> ~/.zshrc
source ~/.zshrc
This allows GPG to interact correctly with your terminal when requesting your passphrase during commit signing.
Step 10 — Verify Commit Signing
Create a signed commit:
git commit -S -m "Test signed commit"
If prompted, enter the passphrase you created when generating your GPG key.
Push the commit to GitHub:
git push
Open the commit on GitHub. You should see a Verified badge next to the commit.
The Verified badge confirms that GitHub successfully validated the GPG signature attached to your commit.
Step 11 — Protect Your Main Branch
For maximum security, enable branch protection rules on your repository.
Navigate to:
Repository → Settings → Branches
Edit your branch protection rule and enable:
✓ Require signed commits
✓ Block force pushes
✓ Require pull request reviews
✓ Require status checks before merging
These protections help ensure that only verified, reviewed, and trusted code can be merged into your main branch.
Let's Wrap!
SSH authentication protects repository access, while GPG signing verifies commit authenticity. Together, they provide a stronger security foundation for your Git workflow and make suspicious or rewritten commits much easier to identify. 🔐
One correction: GitHub doesn't literally have a setting called "Block force pushes" everywhere. Depending on the repository type, you'll typically see "Allow force pushes" (leave disabled) or "Restrict who can force push". So for accuracy, you may want to write:
✓ Require signed commits
✓ Disable force pushes
✓ Require pull request reviews
✓ Require status checks before merging
which is easier for readers to understand.
If you found this blog helpful or have any further questions, we would love to hear from you. Feel free to reach out and follow us on our social media platforms for more tips and tutorials on tech-oriented posts.