---
title: "Fortanix DSM for Git Commit Signing"
slug: "fortanix-dsm-for-git-commit-signing"
updated: 2026-07-08T17:50:20Z
published: 2026-07-08T17:50:20Z
canonical: "support.fortanix.com/fortanix-dsm-for-git-commit-signing"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM for Git Commit Signing

## 1.0 Introduction

This article describes how to use **Fortanix-Data-Security-Manager (DSM)** with **GitHub for Git Commit signing**. GitHub allows users to sign their Git commits locally using GNU Privacy Guard (GPG), Secure Shell (SSH), or Secure/Multipurpose Internet Mail Extensions (S/MIME). GitHub verifies the commit signature using the GPG public key associated with the user’s GitHub account and marks the commit as Verified, indicating that it comes from a trusted source. *For more information, refer to* [*Managing commit signature verification - GitHub Docs*](https://docs.github.com/en/authentication/managing-commit-signature-verification)*.*

## 2.0 Terminology References

- **GPG - GNU Privacy Guard**

GPG is a collection of tools that allow signing and encrypting of data using asymmetric cryptography (with public or private keys). Git uses GPG to sign and verify commits and tags. With such a signature, you can easily verify that a commit (or tag) was really made by a specific user.
- **SSH – Secure Shell**

An SSH key is an access credential for the SSH (secure shell) network protocol. This authenticated and encrypted secure network protocol is used for remote communication between machines on an unsecured open network. Git uses SSH to establish a secure connection through which it can execute commands.
- **S/MIME – Secure/Multipurpose internet Mail Extensions**

S/MIME is a widely accepted protocol for sending digitally signed and encrypted messages. You can use S/MIME to sign commits with an X. 509 key issued by your organization.

## 3.0 Prerequisites

Install the Fortanix Sequoia-PGP client from [*here*](https://fortanix.zendesk.com/hc/en-us/articles/4408325101460-Sequoia-PGP) and follow the instructions in this article to install `sq-dsm`.

## 4.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 4.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 4.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 4.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(12).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 4.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(12).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 4.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-for-git-commit-signing#33-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 4.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 4.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-for-git-commit-signing#34-creating-an-application) to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to use in [*Section 5.0 Sign Git Commits Locally*](/v1/docs/using-fortanix-data-security-manager-for-git-commit-signing#40-sign-git-commits-locally).

## 5.0 Sign Git Commits Locally

You can use Fortanix-DSM (through `sq-dsm`) to create a GPG key and sign their Git commits with the GPG key generated in DSM.

Perform the following steps to sign a Git commit locally:

1. Set the following environment variables in your local environment:
  1. `FORTANIX_API_KEY` with the value of the API key.
  2. `FORTANIX_API_ENDPOINT` with the value of the Fortanix DSM URL.
2. Run the following command to create a GPG key:

```bash
sq-dsm key generate --dsm-key="<DSM-KEY-NAME>" --cipher-suite="<CIPHER-SUITE>" --userid="<EMAIL>"
```

This command will generate a new key. For example,

```bash
sq-dsm key generate --dsm-key="git_key" --cipher-suite="nistp521" --userid="Alice <alice@example.com>"
```

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/GitCommitSigning.png)

**Figure 4: GPG key**
3. Run the following command to extract the certificate:

```bash
sq-dsm key extract-cert --dsm-key="<DSM-KEY-NAME>" > gitkey.asc
```

This command will convert a key to a cert and save it in `gitkey.asc`. For example,

```bash
sq-dsm key extract-cert --dsm-key="git_key" > gitkey.asc
```
4. Add the generated GPG key to your GitHub account:
  1. In your GitHub account, go to **Setting** → **Access** → **SSH and GPG Keys**, and create a new GPG key.
  2. Enter the following details:
    - **Title**: The name of your GPG key.
    - **Key:** Paste the cert (`gitkey.asc`) from the *Step 3*.
  3. To confirm the action, authenticate with your GitHub account.

![CreateNewGPGKey.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/21547340965652.png)

**Figure 5: Create a new GPG key**
5. Run the following `gpg.sh` script to create a `.sh` executable file:

```bash
#!/bin/bash
echo "[GNUPG:] BEGIN_SIGNING" >&2
output=$(sq-dsm sign --detached --dsm-key "<DSM-KEY-NAME>")

if echo "$output" | grep -q "approved"; then
    echo "$output" | sed '1,/approved/d'
elif echo "$output" | grep -q "denied"; then
    exit 1;
else
    echo "$output"
fi

echo "[GNUPG:] SIG_CREATED D" >&2
exit 0;
```

Or you can also use the following batch script as an alternative to the above shell script based on your requirement. Replace `&lt;DSM-KEY-NAME&gt;` with your DSM GPG key name, in the above script.

```bash
@echo off
setlocal enabledelayedexpansion
echo "[GNUPG:] BEGIN_SIGNING" >&2
(set newline=^
%=this line is empty=%
)
for /f "delims=" %%i in ('sq-dsm sign --detached --dsm-key"<DSM-KEY-NAME>"') do (
    set "line=%%i"
    set "output=!output!%%i!newline!"
    echo "!line!" | findstr "approved" > nul 
    if !errorlevel! equ 0 (
      set "output="
    ) 
    echo"!line!" | findstr "denied" > nul 
    if !errorlevel! equ 0 (
      endlocal
      exit /b 1
    ) 
    echo "!line!" | findstr "BEGIN" > nul
    if !errorlevel! equ 0 (
      set "output=!output!!newline!"
    ) 
)
echo !output!
echo "[GNUPG:] SIG_CREATED D" >&2
endlocal
exit /b 0
```

Replace `&lt;DSM-KEY-NAME&gt;` with your DSM GPG key name, in the above scripts. For example,

```bash
sq-dsm sign --detached --dsm-key "git_key"
```
6. Set the local Git configuration using the following steps.
  1. Run the following command to unset the configuration to use the default format of OpenPGP:

```bash
git config --global --unset gpg.format
```
  2. Run the following command to set the primary GPG signing key in Git:

```bash
git config --global user.signingkey <Key ID>
```

Replace the `&lt;KEY ID&gt;` with the **Key ID** of the GPG key added to your GitHub account as described in *Step 4* above.
  3. Run the following command to set the GPG program in Git:

```bash
git config --global gpg.program /path/to/gpg.sh
```
  4. Your GPG key must be associated with a GitHub-verified email linked to your GitHub account that matches your committer identity Set your `EMAIL` used for key creation in Fortanix DSM as `user.email` in Git using the following command, and also ensure that it is a verified email in your GitHub account.

```bash
git config --global user.email <EMAIL>
```
  5. Optionally, you can use the following command to configure Git to sign all commits by default:

```bash
git config --global commit.gpgsign true
```
7. When committing changes, add the `-S` (note that ‘S’ must be capitalized) flag to the `git commit` command if `commit.gpgsign` was not set to `true`. For example,

```bash
git commit -S -m "commit message"
```

## 6.0 Signed Git Commit

You will now get **Signed Git Commits** as shown in the figure below:

![Result.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/21547336150164.png)

**Figure 6: Signed Git commit**

## 7.0 References

- [Managing commit signature verification - GitHub Docs](https://docs.github.com/en/authentication/managing-commit-signature-verification)

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.