# Why We Need to Sign the Commit

Signing commits in version control systems like Git provides several important benefits related to security, authenticity, and accountability.
1. **Authenticity and Trust**:
- **Verification of Author**: A signed commit verifies that the commit was indeed made by the person who claims to have made it. This is crucial in collaborative projects where multiple people are contributing, as it helps ensure that commits are genuine and not tampered with.
- **Preventing Forgery**: Without signed commits, it's possible for someone to forge a commit to appear as if it was made by someone else. Signing commits mitigates this risk by attaching a cryptographic signature that is unique to the author.

2. **Integrity**:
- **Data Integrity**: Signed commits ensure that the commit data has not been altered. If any changes are made to a signed commit, the signature will no longer be valid, alerting users to potential tampering.

3. **Accountability**:
- **Traceability**: Signed commits create a clear and traceable history of changes, showing who made each change and when. This is useful for auditing purposes and for understanding the evolution of a project.
- **Responsibility**: When a commit is signed, it holds the author accountable for the changes they are introducing. This can encourage more careful and responsible coding practices.

4. **Security**:
- **Protection Against Malicious Code**: In open-source projects or projects with many contributors, signed commits help protect against malicious code being introduced into the codebase. Maintainers can configure the repository to only accept signed commits, thereby adding a layer of security.

5. **Compliance**:
- **Meeting Regulatory Requirements**: Some industries and projects have regulatory requirements that mandate traceability and verification of changes. Signed commits help meet these requirements by providing a verifiable record of changes.

## How It Works
To sign commits in Git, you typically use GPG (GNU Privacy Guard) or a similar tool to create a digital signature. This involves:

1. **Generating a GPG Key**: You generate a private and public key pair. The private key is kept secret, and the public key can be shared.
* [Setup GPG key in your Bitbucket account](https://confluence.atlassian.com/bitbucketserver0813/using-gpg-keys-1283689983.html?utm_campaign=in-app-help&utm_medium=in-app-help&utm_source=stash)
2. **Configuring Git**: You configure Git to use your GPG key for signing commits.

    git config --global user.signingkey {KEY_ID}
    git config -l

3. **Signing Commits**: When you create a commit, Git will use your private key to create a digital signature that is attached to the commit.

    git commit -S -m {your commit message}

## Verification
Other users can verify signed commits using the corresponding public key. If the signature is valid, they can be confident that the commit was made by the holder of the private key and that the commit has not been altered.

In summary, signing commits enhances the security, integrity, and accountability of a project, making it an important practice for maintaining a trustworthy and reliable codebase.

## Troubleshooting:
1. **Fail to sign**:
error: gpg failed to sign the data
fatal: failed to write commit object
https://stackoverflow.com/questions/39494631/gpg-failed-to-sign-the-data-fatal-failed-to-write-commit-object-git-2-10-0
2. **Sign old commits**:
https://superuser.com/questions/397149/can-you-gpg-sign-old-commits