https://mvega.dev/tags/git/Recent content in Git on Moises VegaHugoen-usMoises VegaFri, 14 Aug 2026 00:00:00 +0000https://mvega.dev/posts/ssh-commit-signing/Fri, 14 Aug 2026 00:00:00 +0000https://mvega.dev/posts/ssh-commit-signing/<p>Git identity is self-declared. <code>user.email</code> is a config value, not a credential — anyone can set it to your address, commit, and push wherever they have write access. GitHub renders your avatar on the result. Nothing in the process verifies that you wrote anything.</p> <p>Commit signing fixes that, and since Git 2.34 you can do it with the SSH key you already push with. No GPG keyring, no key servers, no expiry dance.</p>