How to Verify Git Commits on GitHub Using GPG Keychain Mac OS

[MyrinNew]

Verifying your Git commits builds trust and shows authenticity. On GitHub, verified commits display a “Verified” badge to signal they were signed with a trusted GPG key.

Here’s a step-by-step guide to setting it up on macOS using the GPG Keychain app.

Prerequisites

• macOS
• GPG Suite installed (includes GPG Keychain)
• Git installed
• GitHub account

Step 1: Generate a GPG Key Using GPG Keychain

1. Open GPG Keychain
2. Click the “New” button.
   
3. Fill in your:
4. Name (should match your GitHub name
5. Email (must match the email you use in your Git commits)
6. Key Type: RSA and RSA (default)
7. Key Length: 4096 bits (recommended)
8. Expiration date: Optional
9. Click “Create Key” and wait until the key is generated.
   

Step 2: Export Your Public Key

1. Right-click your new key and select “Copy”.
   

Step 3: Add the GPG Key to GitHub

1. Go to GitHub → Settings → SSH and GPG Keys.
2. Click “New GPG Key”.
3. Paste the copied key (or the contents of your exported .asc file).
4. Click “Add GPG Key”.
   

Step 4: Configure Git to Sign Commits

Find your GPG key ID:

gpg --list-secret-keys --keyid-format LONG

Look for the line that looks like this:

sec rsa4096/ABCD1234EFGH5678 ..

Then configure Git:

git config --global user.signingkey ABCD1234EFGH5678

git config --global commit.gpgsign true

Set Git to use GPG (this path may vary):

git config --global gpg.program $(which gpg)


Step 5: Make a Signed Commit

git commit -S -m "Your signed commit message"


Push your code to GitHub. If everything is set up correctly, GitHub will show a Verified badge next to your commit.







More...