> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gitar.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Signed Commits

> Verify commits pushed by Gitar using its public GPG key

Gitar GPG-signs all commits it pushes to your repositories, including fix requests, CI failure fixes, and other automated changes. This lets you verify that a commit genuinely came from Gitar and was not tampered with.

## Gitar's Public GPG Key

Use the following public key to verify commits signed by Gitar:

<Accordion title="Public GPG Key (click to expand)">
  ```text theme={null}
  -----BEGIN PGP PUBLIC KEY BLOCK-----

  mQINBGmon8ABEACyVWcSnun7I/s2yIPUCoQabATGQG6HtrXb1j/P93MQ7mk2yw98
  QC7l4VwjDz8ZLDbcshuHz94Mk3hrWVHaeur04LTJgqjJPn/x2ltqEZ++23EFO8xX
  kT0D63kblAJTpjskY6TWGHLX4LRy9u/QZ8NcjPY0ubyE7dFzSyStAEelidXcNMAC
  vAVoL02oAhv0+hGjF7wHjL/lnmU9OZtsFvz+CKnt3/MOiprLRF2kI8927dFeNv2Q
  SaMI9SI2ThDkJnEIE7MxfznOH4s+rezi68fbLaWp7Ns2aQZfxqlAdyeuY2fbg2Nl
  e/2Mb1nFq0Yi2adkMmDRxPnWbfoM8EDfvc7F4tAm9OU7Iiglxr6pLoyvIt7qa1cg
  TVoe8h2oNJZaZ8+H/RPMVV/35jPluRvClE0vp0iFl3McCAwsnA8OoDgwevl00xlM
  Yj0OGKVxywAGm8j7v/ToWhenUVCJsm1bY6ck7RWXJkchkfvvUEzkCjEFLHjuUSPg
  kGQjYvmGmAFpDa5UEXTPMKbRv6zkb9/753oRRbOFQTpmW76u0FFdtazuJcjrNtg9
  7nN8T1HyC3r5pmc4hpDlsShHNUW4yeQ6WFi6fIXMZxLjcM/bTvYngOZgKArUUJy1
  RhhorlwgTa8/kvmkQVxx+WsQHSaxQb0awM+zpY+aH++p4rP2YO3cKgkLhQARAQAB
  tBxHaXRhciBCb3QgPG5vcmVwbHlAZ2l0YXIuYWk+iQJRBBMBCAA7FiEEpDeIc15k
  Fp/l3BQuqERFS2bzdC0FAmmon8ACGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcC
  F4AACgkQqERFS2bzdC3hmQ/+OvrJeNHqtxGDFx+XPd3qMMcYJB2M1atdlNt9W+1D
  fwPXX/ctFAOR5IJ5n0PFr3z4JtShjhc8eqAE8u7pz6rif5Xq13wDYYQ9zyzmJEMj
  lxdIz1w57EXNXky0sMCA2zxfXlsmyQ7WyyJG2EsnVxMmKDELUKCsZa5kPe/aCDTU
  U4bbpAhZr+5Nfbav8DuPuBbYfYTT/ZxVfVDeMSn5r15d6S7qGsJvI0LmeYo/mrTT
  EHshyg+k89EYuwb+5VJH+Rwts7rsXqMvAfFDpJ7jmw/a1jraJ3kdQsN9cxUbbH9x
  xZ0tKxVXPHFASVZ6FB4bLkcVJuufNjE7u2wlOTBDoar7FkSpBwSuYJdPW0mWR4Yy
  QB/8LIDh54TZfBNwEBoYuqQIlOf6GwCCsFp+Wmtu9lMfNHg5JMEgGHlaTKI+oWjY
  0hUGQjYHiBR0gq6YmF1cZyi3H4hz86fxFlDWXhADgPJaLpZD6mls8uVReP4Q+arV
  hr6wa5OfnLhfbgmDB/TdSQiaiBj5ntwzE6BAw28fTop0T+s02hqdh3/0BIo9uK4U
  QIbamg+BJDXGvBuhRlZu5JzYeJZ+CvkyLZIbtj6W09qsy7TNsLfyMB+TYAIE8EeK
  h0n4J2AlWxExVkpsXwDVLTaxoY3AyXUAbgrodISoAV1jAcVpxBck8HagTMBMiYI1
  zdQ=
  =nCrT
  -----END PGP PUBLIC KEY BLOCK-----
  ```
</Accordion>

<Note>
  This key is also available on [GitHub](https://github.com/gitarcode.gpg) for automated retrieval.
</Note>

## Verifying Commits Locally

Two commands, once you have the key above.

Save the public key above to a file, for example `gitar.gpg`, and import it:

```bash theme={null}
gpg --import gitar.gpg
```

Then verify a commit:

```bash theme={null}
git log --show-signature -1 <commit-sha>
```

A valid signature shows `Good signature from "Gitar <...>"` in the output.

## Verified badge, by platform

Gitar signs on every platform. Whether the platform then shows a **Verified** badge depends on where its key is registered.

| Platform | Badge | Setup |
| - | - | - |
| GitHub | Yes | None. Gitar's key is registered |
| GitLab | Yes | None. Gitar's key is registered |
| Bitbucket Data Center | Yes | None. Gitar registers its key on its own account when you connect |
| Azure DevOps | No | The signature is still on the commit and verifies locally |
| Bitbucket Cloud | No | The signature is still on the commit and verifies locally |
| AWS CodeCommit (preview) | No | The signature is still on the commit and verifies locally |

If a commit on GitHub or GitLab has no badge, confirm that the commit's author email matches the email on Gitar's GPG key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.