Sign Commits

Use GPG or SSH keys to sign commits and verify authorship in Harness Code Repository.

Commit signing lets you cryptographically prove that you created a commit and that no one has tampered with it. When you sign a commit, Git attaches a digital signature using your private key, and anyone with your public key can verify that the commit is authentic.

Harness Code Repository supports commit signature verification for both GPG and SSH keys. After you add your public key to your Harness user profile, Harness Code verifies signatures on the commits you push and displays the verification status in the commit listing.

---

What you will learn

• Commit signing: What commit signing is and why it matters for verifying authorship.

• Git configuration: How to configure Git to sign commits with a GPG or an SSH key.

• Verification status: How to read the verification badges on the Commits page.

• Troubleshooting: How to resolve unverified and revoked signatures.

---

Before you begin

• Repository access: You need push access to a Harness Code repository.

• Key pair: You need a GPG or SSH key pair generated on your local machine. Go to Manage public keys to generate one.

• Public key uploaded: Your public key must be present on your Harness user profile. Go to Manage public keys to add it.

---

Configure commit signing

Configure Git to sign your commits with either a GPG key or an SSH key. Use GPG if you already have a GPG key pair or prefer GPG for cryptographic signing. Use SSH if you already use SSH keys for authentication and want a setup without a separate GPG tool.

GPG Key

Step 1: Configure Git to use your GPG key

Find your GPG key ID:

gpg --list-secret-keys --keyid-format=long

In the output, find the sec line. The key ID follows the algorithm and key size. For example, in sec rsa4096/3AA5C34371567BD2, the key ID is 3AA5C34371567BD2.

Tell Git to use this key for signing, replacing 3AA5C34371567BD2 with your own key ID:

git config --global user.signingkey 3AA5C34371567BD2

Step 2: Enable commit signing

To sign all commits by default:

git config --global commit.gpgsign true

Alternatively, sign individual commits by adding the -S flag:

git commit -S -m "Your commit message"

Step 3: Push to Harness Code

Push your signed commits to your Harness Code repository as you normally would:

git push origin main

Harness Code verifies the signature against the GPG public keys on your user profile and displays the verification status on the commit listing page.

Make sure the email address on your GPG key matches the email address associated with your Harness account. Harness uses the committer email to match the signature to your user profile.

SSH Key

Step 1: Configure Git to use SSH for signing

Tell Git to use SSH as the signing format and specify the path to your SSH private key, replacing ~/.ssh/id_ed25519 with your own key path:

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519

Step 2: Enable commit signing

To sign all commits by default:

git config --global commit.gpgsign true

Alternatively, sign individual commits by adding the -S flag:

git commit -S -m "Your commit message"

Step 3: Push to Harness Code

Push your signed commits to your Harness Code repository:

git push origin main

Harness Code verifies the signature against the SSH public keys on your user profile and displays the verification status on the commit listing page.

SSH commit signing requires Git 2.34.0 or later. Check your version with git --version and upgrade if needed.

---

Signature verification statuses

When you view commits on the Commits page in Harness Code, each signed commit displays a verification badge. Unsigned commits do not display a badge.

The badge indicates one of the following statuses:

Badge	Description
Verified	The signature is valid and matches a public key on the committer's Harness user profile. This confirms that the stated author created the commit and that it has not been modified since it was signed.
Unverified	The commit has a signature, but Harness could not verify it. Typically the public key used to create the signature is not on the committer's Harness user profile, or the email address on the key does not match the committer's Harness account. The commit may be legitimate, but its authorship cannot be confirmed.
Revoked	The commit was signed with a key that has since been revoked. A revoked key means the key owner or an administrator explicitly invalidated the key, which can indicate that the key was compromised or is no longer trusted.

---

Troubleshooting

Commits show as Unverified in Harness Code

Verify the following:

1. Your public key is uploaded. Go to your User Profile in Harness and confirm that your GPG or SSH public key appears under My Public Keys. If the key is missing, add it to your profile.

2. Your email addresses match. The email address on your GPG or SSH key must match the email address on your Harness account. To check the email on your GPG key, run `gpg --list-keys --keyid-format=long`. For SSH keys, the email is typically the comment at the end of the public key file.

3. Git is using the correct key. Run `git config --global user.signingkey` to verify your signing key configuration.

4. Your commits are actually signed. Run `git log --show-signature -1` to verify locally. If the output does not show a signature, enable signing with `git config --global commit.gpgsign true`.

Commits show as Revoked in Harness Code

The key used to sign the commits has been explicitly revoked and is no longer considered trustworthy. You cannot reverse a key revocation.

To resolve this:

1. Generate a new GPG or SSH key pair.

2. Add the new public key to your Harness user profile.

3. Update your Git configuration to use the new key.

4. Future commits signed with the new key display as Verified.

If your GPG key was revoked and you need assistance, contact Harness Support.

GPG asks for a passphrase but no prompt appears

Configure the GPG agent to use a terminal-based prompt by running \`export GPG_TTY=$(tty)\`. Add this line to your shell profile (~/.bashrc, ~/.zshrc, or equivalent) so it persists across sessions.

SSH signing fails with unsupported value or similar error

SSH commit signing requires Git version 2.34.0 or later. Check your Git version with \`git --version\`. If your version is older than 2.34.0, upgrade Git to use SSH signing.

---

Next steps

You can now sign commits and confirm that Harness Code recognizes them as verified.

• Manage public keys: Generate and add GPG or SSH keys to your Harness profile.

• Commits: Create and inspect commits in Harness Code.

• Enable security: Enforce committer email verification alongside signing.