Git allows you to configure any name and email address in your local config. When you push commits to GitHub or GitLab, the platform associates the commit with that email address. This means anyone can easily commit malicious code pretending to be you, compromising domain integrity.

The Solution: Cryptographic Commit Signing

GPG (GNU Privacy Guard) commit signing ensures that every commit pushed to a repository is verified by your private cryptographic key. When GitHub sees a signed commit, it displays a green "Verified" badge next to your avatar, proving that the code was authored by you and not spoofed.

Quick Configuration Steps

  1. Generate GPG Key: Run gpg --full-generate-key in your terminal and select RSA 4096-bit encryption.
  2. Export Public Key: Export your public key and add it to your profile settings on GitHub/GitLab.
  3. Configure Git locally: Tell Git to sign commits automatically: 
    git config --global user.signingkey YOUR_GPG_KEY_ID
git config --global commit.gpgsign true

Implementing commit signing protects open-source projects, prevents supply chain attacks, and ensures your developer contributions are cryptographically authenticated.