Lion Cipher Lab
Sign your Git commits so others can prove it was you
- Cyber / Security Engineer
- Beginner
- ~30 min
- Free · no account required
Why it matters
By default Git trusts whatever name and email you type into its config — it never checks them — so anyone can make a commit that claims to be from you, or from a maintainer of a project everyone depends on. That is a real supply-chain problem: attackers have pushed code under trusted-looking identities. Signing your commits attaches cryptographic proof that they came from you, which is what turns the "Verified" badge on. For anyone writing or reviewing code, being able to prove and check authorship is a baseline habit of secure development.
What you'll learn
- Git commit signing
- SSH signing keys
- verifying commit authorship
- supply-chain integrity basics
- protecting a private key
- reading git log --show-signature
Steps in this lab
- The problem: Git believes whatever name you type
- The idea of signing, in plain terms
- Open a terminal and make (or reuse) an SSH key
- Tell Git to sign your commits with that SSH key
- Register the public key with GitHub as a signing key
- Make a signed commit in your own repo
- Verify it — locally and with the badge
- What signing does not do — and the alternative