Reference: Signing Commits with GPG

Creating a GPG Key

Create a key with gpg --gen-key and input your name, email address, and passphrase when prompted. For more options, use gpg --full-generate-key.

To view secret keys: gpg --list-secret-keys or gpg -K

To export secret keys: gpg --export-secret-keys $ID > private-key.asc

To export public key for sharing: gpg --armor --export $ID > public-key.asc or gpg --armor --export $EMAIL > public-key.asc

Using the GPG Key with Git

In your git repo:

git config user.signingkey $ID

To sign a commit:

git commit -S -m "Commit message"

To auto sign commits:

git config commit.gpgsign true

To view commits with signature information:

git log --show-signature