# Signed Commits

Orxaq requires signed commits for auditability.
Two options (SSH is easier for Mac):

## Option A: SSH signing (recommended)

```bash
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true
```

## Option B: GPG signing

```bash
gpg --full-generate-key
git config --global user.signingkey <KEY-ID>
git config --global commit.gpgsign true
```

## Upload public key to GitHub

Settings > SSH and GPG keys > New signing key

## Verify

```bash
git log --show-signature
```

## Enforcement

Signed commits are not yet enforced in the branch ruleset.
After the Operator configures their signing key, enforcement
will be added in a follow-up PR.
