Signed commits | GitLab Docs Skip to main content Go to GitLab Docs homepage What's new? What's new? Get free trial Toggle menu * Use GitLab * GitLab Duo * GitLab Orbit * Extend * Install * Administer * Subscribe * Contribute * Solutions Getting started Tutorials Manage your organization Organize work with projects Plan and track work Manage authentication and authorization Use Git Manage your code Getting started Repositories Protect your repository Branches Compare revisions Commits Forks File management File tree browser Repository size Tags Code Owners Mirroring Changelogs Snippets Push rules Signed commits GPG keys SSH keys X.509 certificates GitLab UI commits Managing monorepos MLOps Merge requests Remote development Use CI/CD to build your application Secure your application Deploy and release your application Manage your infrastructure Monitor your application Analyze GitLab usage Release notes Feature support Find your GitLab version * GitLab Docs / * Use GitLab / * Manage your code / * Repositories / * Signed commits Help us learn about your current experience with the documentation. Take the survey . Signed commits * Tier : Free, Premium, Ultimate * Offering : GitLab.com, GitLab Self-Managed, GitLab Dedicated When you add a digital signature to your commit, you provide extra assurance that a commit originated from you, rather than an impersonator. A digital signature is a cryptographic output used to verify authenticity. It s important to understand the difference between signed and verified commits: * Signed commits have a cryptographic signature attached that proves the commit s integrity and authenticity. The signature is created using a private key. * Verified commits have signatures that GitLab can validate against a known public key stored in a user s GitLab profile. If GitLab can verify the committer s identity with a public key, the commit is marked Verified in the GitLab UI. The committer and author fields are distinct in Git. The author writes the commit, and the committer applies it. Commit signing verifies only the committer s identity. GitLab verifies signatures on commits and tags. The following signing methods are supported: * SSH key * GPG key * X.509 certificate Verify commits To review commits for a merge request, or for an entire project, and verify they are signed: * In the top bar, select Search or go to and find your project. * To review commits: * For a project, select Code > Commits . * For a merge request: * In the left sidebar, select Code > Merge requests , then select your merge request. * Select Commits . * Identify the commit you want to review. Depending on the verification status of the signature, signed commits display either a Verified or Unverified badge. Unsigned commits do not display a badge. * To display the signature details for a commit, select Verified or Unverified to see the fingerprint or key ID: You can also use the commits API to check a commit s signature. Verify GitLab-signed commits GitLab signs the commits it creates, like commits made through the web UI, with a key configured on the instance. To verify these commits locally, obtain the GitLab public key for signing commits using the web commits API . The signature stays with the commit when the commit is copied to another project, for example by repository mirroring . In the target project, GitLab displays the Verified badge only if the instance is configured with the key that signed the commit. Warning badge for unverified committer email History * Introduced in GitLab 17.5 with a feature flag named check_for_mailmapped_commit_emails . Disabled by default. * Enabled on GitLab.com in GitLab 18.9. * Generally available in GitLab 19.1. Feature flag check_for_mailmapped_commit_emails removed. When a verified signed commit s committer email is no longer verified to the signing user, GitLab displays an orange verified badge with a warning sign ( Verified ). This can occur when the committer email was removed from the user s verified emails. To restore the green Verified badge, add the committer email address to your GitLab profile and verify it. Enforce signed commits with push rules * Tier : Premium, Ultimate * Offering : GitLab.com, GitLab Self-Managed, GitLab Dedicated You can require signed commits across your projects using push rules. The Reject unsigned commits push rule prevents any unsigned commits from being pushed to a repository, helping organizations maintain code integrity and meet compliance requirements. For more information about how this rule works and its limitations, see require signed commits . Troubleshooting Fix verification problems with signed commits The verification process for commits signed with GPG keys or X.509 certificates can fail for multiple reasons: Value Description Possible fixes UNVERIFIED The commit signature is not valid. Sign the commit with a valid signature. SAME_USER_DIFFERENT_EMAIL The GPG key used to sign the commit does not contain the committer email, but does contain a different valid email for the committer. Amend the commit to use an email address that matches the GPG key, or update the GPG key to include the email address . OTHER_USER The signature and GPG key are valid, but the key belongs to a different user than the committer. Amend the commit to use the correct email address, or amend the commit to use a GPG key associated with your user. UNVERIFIED_KEY The key associated with the GPG signature has no verified email address associated with the committer. Add and verify the email to your GitLab profile, update the GPG key to include the email address , or amend the commit to use a different committer email address. UNKNOWN_KEY The GPG key associated with the GPG signature for this commit is unknown to GitLab. Add the GPG key to your GitLab profile. MULTIPLE_SIGNATURES Multiple GPG or X.509 signatures have been found for the commit. Amend the commit to use only one GPG or X.509 signature. * Verify commits * Verify GitLab-signed commits * Warning badge for unverified committer email * Enforce signed commits with push rules * Troubleshooting * Fix verification problems with signed commits * Facebook * LinkedIn * Twitter * YouTube Company * About GitLab * View pricing * Try GitLab for free Feedback * View page source * Edit in Web IDE * Contribute to GitLab * Suggest updates Help & Community * Get certified * Get support * Post on the GitLab forum Resources * Terms * Privacy statement * Use of generative AI * Acceptable use of user licenses *