Skip to main content

​
Overview

Gitar GPG-signs all commits it pushes to your repositories, including fix requests, CI failure fixes, and other automated changes. This lets you verify that a commit genuinely came from Gitar and was not tampered with.

​
Gitar’s Public GPG Key

Use the following public key to verify commits signed by Gitar:
This key is also available on GitHub for automated retrieval.

​
Verifying Commits Locally

1. Import the key Save the public key above to a file (e.g. gitar.gpg) and import it:
2. Verify a commit
A valid signature will show Good signature from "Gitar <...>" in the output.

​
Verified Badge on GitHub / GitLab

Once the hosting platform trusts Gitar’s signing key, commits pushed by Gitar display a Verified badge automatically.
  • GitHub — GitHub shows the badge once the GPG key is associated with the committer’s account. Gitar’s key is registered, so no action is needed on your part.
  • GitLab — GitLab similarly displays a Verified badge for commits signed with a GPG key linked to the committer. No additional setup is required.
If you do not see the Verified badge on a Gitar commit, confirm that the commit’s author email matches the email associated with Gitar’s GPG key.