Verified commits (GPG and SSH)#

Sign your commits with GPG or an SSH key so they carry a green Verified badge — create a key, register its public half on rickub, and point git at it.

What makes a commit Verified#

Commit pages and commit lists check signatures when they render. A commit shows Verified only when all three of these hold:

• the commit is signed — a signature carried in the commit's gpgsig header, either an OpenPGP signature (GPG) or an SSHSIG block (SSH);
• the signature validates against a key registered on your account — a GPG key added under Settings → GPG keys, or an SSH key added under Settings → Signing keys. Signing subkeys work for GPG; an SSH key registered only for authentication (Settings → SSH keys) never verifies commits;
• the commit's committer email (git config user.email) matches an email verified on your rickub account — the account email or any address confirmed under Settings → Emails — case-insensitively.

The third rule is deliberate: a signature proves a key made it, not that the key's owner is the committer. A valid signature whose owner has not verified the committer email renders as Unverified — rickub won't vouch for an identity it can't bind.

1. Create a signing key (if you don't have one)#

With GPG#

gpg --full-generate-key

Accept the default key type, enter your name, and give the key an email you have verified on your rickub account — that is the address rickub shows next to the key, and the one your commits' committer email must match.

With SSH#

Any SSH key type git supports works (ed25519 is a good default):

ssh-keygen -t ed25519 -f ~/.ssh/signing_key -C "you@your-email"

You can use the same key pair for signing and authentication, but you don't have to — and registering it for one purpose never grants the other.

2. Register the public half#

GPG#

Export the armored public key and paste the whole block — from -----BEGIN PGP PUBLIC KEY BLOCK----- to -----END PGP PUBLIC KEY BLOCK----- — into Settings → GPG keys, then press Continue:

gpg --list-secret-keys --keyid-format long   # find your key's fingerprint
gpg --armor --export FINGERPRINT

To prove you hold the private key, rickub then shows a one-time challenge together with the command that signs it. Copy the command from the page, run it in a terminal, and paste the entire -----BEGIN PGP SIGNED MESSAGE----- block it prints back into the form:

echo 'rickub-gpg-challenge|…' | gpg --clearsign

gpg signs with your default secret key and prints the clearsigned block on standard output — copy everything from -----BEGIN to END PGP SIGNATURE-----. The challenge expires after 15 minutes; if it has expired by the time you submit, paste your public key again to get a fresh one.

SSH#

Paste the public key (the contents of ~/.ssh/signing_key.pub) into Settings → Signing keys and give it a title. No challenge step: unlike a GPG key, registering an SSH public key you don't hold verifies nothing, because a commit only ever verifies when its signature was produced by the key's private half and its committer email is verified as yours.

3. Point git at the key#

GPG#

git config --global user.signingkey FINGERPRINT
git config --global user.email "you@your-account-email"   # must match a verified email
git config --global commit.gpgsign true                   # sign every commit from now on

SSH#

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/signing_key    # the PRIVATE key
git config --global user.email "you@your-account-email"   # must match a verified email
git config --global commit.gpgsign true                   # sign every commit from now on

With commit.gpgsign on, a plain git commit is signed; use git commit -S to sign a single commit without turning it on globally. Tags work the same way with git tag -s (GPG) or git tag -s under gpg.format=ssh (SSH).

Using more than one email address#

Committing from work under a different address than your account email? Add it under Settings → Emails: rickub mails a confirmation link, and once confirmed, commits carrying that address as the committer email verify like your account email does — for GPG- and SSH-signed commits alike.

If commits still show Unverified#

• "gpg: signing failed: Inappropriate ioctl for device" — common in tmux, CI, and some IDE terminals. Point gpg at a terminal before committing: export GPG_TTY=$(tty).
• The signature doesn't verify — check that you registered the key git actually signs with (git config user.signingkey), and inspect what git sees with git log --show-signature. If git signs with a subkey, export the primary fingerprint: gpg --armor --export includes the subkeys.
• The signature verifies but the badge stays Unverified — the committer email doesn't match any email verified on your account. Fix your git config user.email, your account email in Settings, or confirm the address under Settings → Emails.
• An SSH key registered for authentication doesn't verify commits — that's by design. Auth keys grant git access; only keys registered under Settings → Signing keys vouch commits.
• Nothing is signed at all — commit.gpgsign is off or set only in another repository. git config --get commit.gpgsign inside the repo tells you what applies.