Configure commit and tag signing
Preferences › Commit Signing picks the Format (OpenPGP, SSH key or X.509) and Key, and whether to Sign every commit and Sign every annotated tag. Nothing is written until you press Apply to Global Git Config. The graph and commit details then show each commit’s signature state.
Works in GitTree Free: every local Git feature, once you are signed in.
On this page
Before you start
- A GnuPG secret key, or an SSH key in your
.sshfolder, for signing.
Where to find it
- Preferences › Commit Signing.
| Action | macOS | Windows and Linux |
|---|---|---|
| Preferences | ⌘, | Ctrl+, |
Steps
Pick format and key
Under Choose a signing key, choose the Format and the Key. No key lets git find one from your email.
Choose what to sign
Tick Sign every commit and, if you want, Sign every annotated tag.
Apply
Press Apply to Global Git Config. GitTree says Signing settings were written to your global git config.
Check a commit
Make a commit and look at it in the graph: it shows Good signature from … when the key is trusted.
Expected result
Your commits and tags are signed, and you can see who signed every commit.
Signature states
| GitTree says | Meaning |
|---|---|
| Good signature from … | Signed and the key is trusted. |
| Signed by …, but the key is not trusted | Signed, but not by a key you trust. |
| Signed, but the key is not available to check it | The public key is missing here. |
| Bad signature | The commit does not match its signature. |
| Not signed | No signature. |
SSH signatures are checked against Trusted SSH signers file (gpg.ssh.allowedSignersFile); without it they cannot be checked. A profile with its own signing key overrides this key while it is active.
If something goes wrong
“No GnuPG secret keys were found.”
Create or import a GnuPG key first, or choose SSH key as the format.
Questions
Does this change other git tools?
Yes: it writes your global git config, which every git tool reads. That is why nothing is written until you apply.