Gitsign is a Sigstore tool that signs Git commits and tags with a short lived certificate tied to your OIDC identity, so you need no long lived signing key. Each signature is logged in Rekor so it stays verifiable after the certificate expires.
How it works
When you sign, gitsign opens your browser to the Sigstore OIDC login. It does not keep signing keys or refresh tokens on disk. The commit is signed with a certificate that, per the README, lasts about ten minutes on the public instance, and the signing event is recorded in the Rekor transparency log.
Compare that with key based signing, where a stolen laptop or leaked key can sign as you until someone notices.
Set it up
For one repository:
git config --local gpg.x509.program gitsign
git config --local gpg.format x509
git config --local commit.gpgsign true
git config --local tag.gpgsign true
The first two lines are required. The last two make signing automatic, and the README warns they make commits depend on internet access. Without them, sign per commit with the signing flag.
Verify
gitsign verify --certificate-identity=name@example.com --certificate-oidc-issuer=https://accounts.example.com HEAD
The README prefers this over git verify-commit, because the git commands do not pass identity information to the signing tool and print a warning that cert claims are not verified. That is the same lesson as with images: a valid signature without an identity check proves little.
Is it right for you?
| Factor | Gitsign | Key based signing |
|---|---|---|
| Keys to manage | None | Yours to store and rotate |
| Needs a browser login | Yes | No |
| Works offline when signing | No | Yes |
| Shows as verified on GitHub | No, per the README | Depends on key type |
| Identity in the signature | OIDC identity | Key owner |
Limits to plan around
- Signing needs a browser for login, with caching options to cut friction.
- CI without a terminal needs logging set to a file.
- By default data goes to the public Rekor instance, and certificates can contain emails or repository identifiers, which matters for private repositories.
- The README marks offline verification as experimental.
- GitHub does not show gitsign signatures as verified, because the Sigstore CA root is not in its trust root.
What a signed commit does and does not prove
It ties a commit to an identity at a time. It does not prove the change is correct or reviewed. For source assurance, pair signing with branch protection and review.
Where Safeguard fits
Safeguard's policy gates and dependency scanning check what a commit introduces, which signing alone cannot do.
Quick check
Does gitsign replace code review?
No. It proves who signed, not that the change is good.
Why not use git verify-commit?
Per the README, it does not verify the certificate claims, so you lose the identity check.
Sources
Last reviewed: 19 October 2026.
