How to GPG sign only a particular unsigned commit?

Question

I have an issue where I committed something earlier without GPG signing it while for the rest of the commits, I installed gpg and signed them. I want to gpg sign this one particular commits. Is there an apt way to gpg sign a particular commit using the commit hash?

Answer 1

A commit is signed at the time the commit is created -- the signature is part of the commit.

Depending on your situation you have three options:

• Create a signed followup-commit. Note that you can create empty commits with --allow-empty.
• Amend the last commit and sign it. This is "history rewriting" (search term) and should be done if you understand the consequences for your peers.
• Create a signed tag pointing to you commit and communicate the tag.