Signing commits with GPG is a useful technique for verifying the authenticity and integrity of code changes - here’s how you can set it up.

Creating keys

First you’ll need to create a key-pair to start signing commits. Run the following command and follow the prompts (if in doubt accept the default settings).

gpg --full-generate-key

This should give you a primary key for signing and for certifying other keys, and a subkey for encryption: