Commit signing

Commit signing

GPG

The dev-tools role installs gnupg and pinentry-mac and writes ~/.gnupg/gpg-agent.conf, so GPG signing works if you already carry a key.

SSH signing (simpler)

If your SSH keys live in an agent (Bitwarden, 1Password, ssh-agent), SSH signing is less work than a GPG keyring: git supports it since 2.34, and there is no key material on disk. The dotfiles do it this way:

# ~/.gitconfig-personal-github (and -gitlab, with the GitLab noreply address)
[user]
    email = <id>+<user>@users.noreply.github.com
    signingkey = key::ssh-ed25519 AAAA...
[gpg]
    format = ssh
[commit]
    gpgsign = true

• key:: means "this is the key itself", not a path: git hands the public key to the agent, which signs with the private half.
• Register the same public key on GitHub a second time, under Settings → SSH and GPG keys, with key type Signing Key. A key registered only for authentication won't verify signatures.
• git log --show-signature says No signature until gpg.ssh.allowedSignersFile points at a file mapping emails to keys (the dotfiles ship .config/git/allowed_signers). That is local verification only: GitHub verifies against the keys on your account.