Commit Signing
Overview
Commit signing verifies the identity of the author of a Git commit by attaching a cryptographic signature. GitLab uses this signature to confirm that a trusted identity created a commit and has not been modified after it was signed.
All commits to Party Bus-supported repositories must be signed using one of the following methods:
- CAC signing
- GPG key signing
For projects operating in IL4 and IL5 environments, CAC signing is required.
Choose a Commit Signing Method
Select the guide that matches your environment and credentials.
Commit Signing with a CAC
Use a CAC if you have a DoD-issued CAC and want to sign commits using your certificate.
Commit Signing with a GPG Key
Use a GPG key if you do not use a CAC for commit signing or if your project permits GPG-signed commits.
Before You Begin
Before configuring commit signing:
- Install Git.
- Verify that your GitLab account is configured with the correct commit email address.
- Ensure you have access to the signing credential required for your chosen method (CAC certificate or GPG key).