276

Git now has the ability to sign commits with git commit -S, which is great, but sometimes I forget the flag to commit, and sometimes I mail myself patches which I apply with am, and that command doesn't have a flag for signing.

Is there a way to add a signature to an already recorded commit?

3
  • 39
    For the record, you can tell git to always sign commits via configuration: git config commit.gpgsign true.
    – ichigolas
    Commented Oct 23, 2018 at 12:47
  • @nicooga I wish your comment had more upvotes so I noticed this earlier. I've had to pull up this question at least half a dozen times, and setting that flag would've saved me a bunch of time. Commented Sep 16, 2019 at 21:28
  • 1
    If the commits have already been published, you should not rewrite them for any purpose (except removing accidental data leaks), as this would change their commit IDs. You don't need to sign those old commits explicitly, at least not for data integrity purposes. Since each commit contains SHA-1-based IDs of its parents, verifying any single commit will also implicitly verify its entire history via the hash chain. superuser.com/questions/1144817/… Commented Nov 25, 2020 at 14:08

12 Answers 12

299
  1. Go into interactive rebase mode.
  2. Add the following line after each commit you want to sign

    exec git commit --amend --no-edit -S

This will run this command after picking each commit.

UPDATE:

Easier way to do this is:

git rebase --exec 'git commit --amend --no-edit -n -S' -i development

This rebases everything till development (or any hash) and you don't have to copy paste after every commit.

14
  • 14
    Oh I wish I had found this sooner. I read so many things, even from GitHub themselves, saying that you can't resign old commits. This proves that completely false! I could have saved hundreds of commits, which I have now squashed. Oh well... thanks for sharing! I made an alias out of this. resign = "!re() { git rebase --exec 'git commit --amend --no-edit -n -S' -i $1; }; re" becomes git resign HASH
    – i i
    Commented Jul 6, 2017 at 21:16
  • 4
    This should be common knowledge! You have done a great service for humanity (no sarc!)!
    – hopeseekr
    Commented Feb 3, 2018 at 20:25
  • 7
    There's no reason to rebase at all. Just run git commit --amend --no-edit -n -S. Commented Mar 6, 2018 at 1:51
  • 44
    Doesn’t this change the history, requiring a git push --force?
    – Steve
    Commented Apr 14, 2018 at 17:21
  • 11
    @BarryMode people are correct in that you can't resign old commits. Technically this answer does not resign an old commit, but just creates a new commit containing the same content with an additional signature. It is not the same commit in that force push is required.
    – SOFe
    Commented Apr 16, 2020 at 1:53
76

Signing a commit changes its contents, so more recent commits depending on it will change their hash.

If you just want to sign the most recent commit, git commit -S --amend will work.

3
  • 4
    Most of the time signing the most recent commit, or even creating an empty signed commit on top of it will be sufficient to guarantee authenticity. Git commits are a Merkle tree, so modification of any ancestor commit requires rewrite of its descendants, thus invalidating the signature.
    – gronostaj
    Commented Jul 22, 2020 at 12:38
  • 1
    @gronostaj That is only true though as long as there are no SHA-1 preimage attack is found. This is not the case currently, however git is moving away from SHA-1 already.
    – rugk
    Commented Jan 21, 2021 at 13:05
  • 3
    I imagine many of the users coming here are looking to resign all commits away while preserving commit metadata other than the commit SHA after a git-filter-repo strips them away.
    – vhs
    Commented Mar 4, 2022 at 10:58
34

I use git rebase -i --root ( see Rewriting History ) and change pick to edit.

Then I use git commit -S --amend --no-edit && git rebase --continue (on Windows) for each commits.

This is manually sign for each commits. I hope we will found better solution.

2
  • I have my home directory as a git repo (for dotfiles). Some programs interactively pick up changes as its rebasing, funny to see the history being replayed live. It's slow enough because signing is slow Commented Jan 22, 2017 at 1:33
  • I tried this and got error: gpg failed to sign the data fatal: failed to write commit object
    – Jackie
    Commented Apr 30, 2022 at 16:47
26

If you need to GPG sign all commits SINCE a particular commit on the current branch, you can use the following instead:

git filter-branch --commit-filter 'git commit-tree -S "$@";' <COMMIT>..HEAD

Where <COMMIT> is the commit id (e.g. abc123e5).

This has the added benefit that it does not disturb the commit metadata (including commit date). The commit hashes will change, though (since it's a digest of the contents of each commit, and a signature is being added to each commit).

If you also would like to stop getting prompted for your GPG passphrase on every commit, also see this answer: https://askubuntu.com/a/805550

NOTE: Switching from gpg to gpg2 for GIT signing will require you to re-import your private key in GPG 2.

3
  • 1
    One can also add --env-filter 'export GIT_COMMITTER_DATE="$GIT_AUTHOR_DATE"' to ensure the commit date is not reset to today's date.
    – Arjan
    Commented Dec 27, 2020 at 20:42
  • The downside with using the author date as the committer date is that you'll lose the commit date on rebased/cherry-picked/amended commits.
    – GuyPaddock
    Commented Feb 20, 2021 at 14:49
  • @Arjan it already does not modify the commit date as noted in the answer.
    – vhs
    Commented Mar 4, 2022 at 11:26
13

If you want to filter only specific commits and sign only them you can use filter-branch:

git filter-branch --commit-filter 'if [ "$GIT_COMMITTER_EMAIL" = "[email protected]" ];
  then git commit-tree -S "$@";
  else git commit-tree "$@";
  fi' HEAD

This is useful if, for some reason, you want to sign only your own commits.

12

I also stumbled on the same problem and here is my solution:

git rebase -i --root --exec 'git commit --amend --no-edit --no-verify -S'

this will sign all of my commits from the first initial commit and also bypass commit hook that I set up using husky. No need to change pick to edit.

1
  • 6
    This one modifies the commit date. The commit date is set to the current time.
    – rugk
    Commented Jan 21, 2021 at 12:57
8

If no filtering on commit is needed, then it is preferred to use rebase than filter-branch:

git rebase -i master --exec 'git commit --amend --no-edit --no-verify -S --reset-author'

Else, you can leave untouched the commits you don't own.
Set the following alias in ~/.gitconfig (replace [email protected] with your email address):

resign = "!_() { : git checkout ; [ \"$#\" -eq 0 ] && echo 'Usage: resign <rev-list>' && exit 2; \
                   git filter-branch --commit-filter ' \
                   if [ \"$GIT_COMMITTER_EMAIL\" = \"[email protected]\" ]; then git commit-tree -S \"$@\"; else git commit-tree \"$@\"; fi' $1; }; _"

Then for instance, to resign all your commits in the current branch pulled from master, do:

git resign master..

Credits to previous answers by BarryMode and Roberto Leinardi

4

here's the one I use for all commits, yes it will re-write history:

git rebase --exec 'git commit --amend --no-edit -n -S' -i --root
2
  • 7
    Note that this resets the commit date to today's date.
    – Arjan
    Commented Dec 27, 2020 at 20:43
  • --env-filter 'export GIT_COMMITTER_DATE="$GIT_AUTHOR_DATE"' can be used to counteract that. See @Arjan's comment on another answer. Commented May 29 at 9:36
4

Here's how to re-sign all of the commits on current branch while preserving original author and timestamp:

git rebase -i --root --exec 'env GIT_AUTHOR_DATE="$(git log --no-walk --format=%ad)" GIT_COMMITTER_DATE="$(git log --no-walk --format=%cd)" git commit --amend --allow-empty --no-edit --no-verify -S --reset-author'

PowerShell version of the above for Windows users:

git rebase -i --root --exec '$env:GIT_AUTHOR_DATE="$(git log --no-walk --format=%ad)"; $env:GIT_COMMITTER_DATE="$(git log --no-walk --format=%cd)"; git commit --amend --allow-empty --no-edit --no-verify -S --reset-author'

What this does:

  • git rebase -i --root --exec: Starts an interactive rebase starting from the root commit (the first commit) of your current branch. The --exec option allows us to specify a shell command to run after each commit.
  • git log --no-walk --format=%ad is the author date (%ad) which we assign to GIT_AUTHOR_DATE
  • git log --no-walk --format=%cd is the committer date (%cd) which we assign to GIT_COMMITTER_DATE
  • We then amend the current commit with those dates, thereby re-signing the commit
    • --allow-empty allows commits with no changes,
    • --no-edit uses the existing commit message,
    • --no-verify skips pre-commit and commit-msg hooks,
    • -S signs the commit, and --reset-author updates the author date and time.

Finally, you may need to run:

(git pull --allow-unrelated-histories || git merge --strategy-option ours --allow-unrelated-histories) && git push

In case you have un-pushed local commits, you may need to merge before pushing, hence the git merge fallback in the above combo.

2
  • 1
    Credit: stackoverflow.com/questions/67971851/…
    – Dan Cecile
    Commented May 16, 2023 at 3:45
  • 2
    If you're pushing to a remote Git server, after running this command, note that you might get a fatal: refusing to merge unrelated histories error with any subsequent commits/pull/fetch/merge... That's to be expected — after all, the remote has a different history, full of unsigned commits. There are many ways of dealing with this situation (depending on what solution you prefer) and a reasonably thorough explanation of the error and how to fix it (with graphics!!) is here: stackoverflow.com/a/39783462/1035977 Commented Aug 1, 2023 at 14:33
3

To sign off last N commits, you can also do:

git rebase HEAD~N --signoff
3
1

One simple solution to sign all commits

git rebase --root --gpg-sign --committer-date-is-author-date

Source: https://rollen.io/blog/resigning-git-commits/

0

For those not experimented using git, if you need to do it to one specific commit:

  • Locate the commit hash (1234)
  • I knew in my case was the prior to the last one so I used git rebase -i HEAD~2.
  • One screen will show up, locate the hash (1234) and change the word pick to edit.
  • save: Esc then :wq!
  • execute in the terminal git commit --amend --no-edit -S.
  • execute in the terminal git rebase --continue
  • Then push The edited hashes will change! Greetings!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .