Signing commits

Tangled supports SSH commit signatures. For verified commits, Tangled displays a green badge and the fingerprint of the SSH key used to sign that commit.

Signing with SSH

To sign commits using your SSH key in git:

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

The key you sign with can be any key that has been added to your Tangled account in Settings → SSH Keys.

If you are using Jujutsu, add this to your config:

[signing]
behavior = "own"
backend = "ssh"
key = "~/.ssh/id_ed25519.pub"

Linking commits to your account

Tangled maps a commit to your account when its author email is either:

• one of your verified emails (add them under Settings → Emails and open the link sent to each), or
• your DID itself, for example git config user.email did:plc:abcd1234.

Authors of linked commits are listed correctly in the repository page, in blame views, and in Signed-off-by: trailers. Only verified emails count, so nobody can claim your commits by adding your address to their account. Commits with an unverified or unknown email still exist and display normally; they just aren’t linked to your Tangled account.