Signing Commits & Pro Config

Signing commits (trust)

Recall from the very first module that git config user.name/user.email simply tells Git who you are - nothing stops anyone from setting those to your name and committing as "you" on a machine they control. Signed commits close that gap: using a GPG or SSH key you privately hold, Git cryptographically proves a specific commit really was authored by the holder of that key - which is exactly what earns GitHub's green "Verified" badge next to a commit.

$ git config --global commit.gpgsign true
$ git config --global user.signingkey <key-id>
$ git commit -S -m "Signed commit"    # -S signs a single commit

Config levels & aliases

Every git config setting can be set at three different scopes, and Git resolves conflicts by preferring the most specific one:

More specific always wins: a --local setting in one repo overrides your --global default, which in turn overrides any --system default.

Beyond identity and signing, git config is also how you define your own shortcuts, called aliases, for commands you type often:

$ git config --global alias.lg "log --oneline --graph --all"
$ git config --global alias.st status
$ git lg      # now your custom shortcut for that long log command

Tip: A few well-chosen aliases (lg, st, co) and setting pull.rebase=true (so git pull rebases instead of merge-committing by default) will noticeably speed up your daily Git usage. Set them once with --global and every repo you ever work in inherits them automatically.

Goal: You've now covered Git end to end - fundamentals, branching, collaboration, history surgery, and the professional power tools. Pair each topic with the Git labs to make it muscle memory: reading about rebase and actually resolving a rebase conflict under time pressure are very different skills, and only practice builds the second one.