Push signed

[lazize]

Hi,

Does GitHub support signed push?

I am getting this error message:

 $ git push --signed=true
 Username for 'https://github.com': user
 Password for 'https://[email protected]':
 fatal: the receiving end does not support --signed push
 fatal: The remote end hung up unexpectedly
 error: failed to push some refs to 'https://github.com/user/repo.git'

[ThirdEyeRose]

Hi @lazize,

GitHub does support GPG signed commits. For more information, please see the GitHub help article, Signing commits using GPG.

Thanks!

[lazize]

Hi,

Yes, it supports signed commit, it means the example below works fine.

Please not that only commit is signed.

git commit -S -m "message"
git push

But I am asking about signed push, not only signed commit.

Note that on example below both, commit and push, are signed and it fails with the error message I posted.

git commit -S -m "message"
git push --signed=true

[lee-dohm]

No, GitHub does not currently support GPG signed pushes, only signed commits.

[kushaldas]

Hi from 2021, can we do GPG signed push now? or enable it somehow?

[potentialuser54]

Hi from 2022. Just ran into this.

@lee-dohm Could you give any reason as to why GitHub does not support signed pushes. and is there any plan to support it?

[rahilarious]

it seems that neither github or gitlab supports it. 😔

[mbledkowski]

Why is this feature not supported?

[RogueScholar]

I don't understand it either. Back in 2018 when the feature was new, okay, I can see the benefit to waiting for a new feature to be acid tested before rolling it out in production. But now? It's been in use for over six years, and this thread and a similar one at GitLab's gitaly repo are testaments that there are at least a few of us out there using it day-to-day…seems to me like its time has come, especially when the world we live in only seems to get less, not more, secure.

[LeviPesin]

This seems to be not very hard to enable, why is it still not?

[suhasdotcom]

They may have a good reason to not do it. I do not know what it may be. It seems quiet counter-intuitive to not support it.

If someone wants to support this feature on a remote that they control, check this article.