Git and GitHub the Safe Way, Ch. 2: Setup That Lasts
Part of Git and GitHub the Safe Way, a short book on git, GitHub, and the habits that keep a repository from hurting you.
Twenty minutes, once per machine. Everything here is written to a file in your home folder called .gitconfig, and at the end of the chapter you will read that file and understand every line. Nothing in it is hard; most people simply never do it, and then spend years typing a password for every push and wondering why their commits show up under the wrong name.
Who you are
Every commit carries a name and an email. Set them once for every repository on the machine:
git config --global user.name "Ada Gopher"
git config --global user.email "ada@example.com"
Use the email on your GitHub account; that is how GitHub links a commit to a person. If you would rather not publish your real address, GitHub gives everyone a private one of the form 12345678+ada@users.noreply.github.com (Settings, Emails, “Keep my email addresses private”); use that here and GitHub still attributes the commits to you.
Two settings that remove friction
git config --global init.defaultBranch main
git config --global core.editor "code --wait"
The first makes every new repository start on main, which is what GitHub expects and what every chapter here assumes. The second names the editor git opens when it needs a message from you and you did not give one with -m. code --wait is VS Code; nano is a fine choice if you do not use VS Code, and it saves you from the day git opens vi and you cannot find the exit.
A key instead of a password
Every push to GitHub has to prove it is you. Passwords are not allowed for that any more, and the token GitHub would give you instead is a password with extra steps. The lasting answer is an SSH key: a pair of files, one private and one public. The public half goes to GitHub; the private half never leaves your machine; git uses them to prove who you are without anything secret crossing the wire.
Make one. The command is the same on all three operating systems (Windows has had it built in since 2018):
ssh-keygen -t ed25519 -C "ada@example.com"
Press Enter to accept the default location, then choose a passphrase. A passphrase means that someone who copies the file still cannot use it; your operating system will remember it after the first use, so you type it rarely. Two files appear in ~/.ssh: id_ed25519 is the private key, which you never share, never email and never paste anywhere, and id_ed25519.pub is the public one:
cat ~/.ssh/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXyF7Xg+xTi1OSuHaVEltSyqa7kFT4CV7dxLW6KdXT2 ada@example.com
Copy that whole line. pbcopy < ~/.ssh/id_ed25519.pub puts it on the clipboard on macOS, clip < ~/.ssh/id_ed25519.pub on Windows (if PowerShell complains, cat ~/.ssh/id_ed25519.pub | clip), and on Linux select it in the terminal.
Now give it to GitHub, following GitHub’s own steps: your profile picture, Settings, then SSH and GPG keys in the sidebar, then New SSH key. Give it a title that names the machine (“laptop, 2026”), leave the key type as the authentication key, paste the line into Key, and click Add SSH key.
Test it:
ssh -T git@github.com
The first time, it asks whether to trust GitHub’s server fingerprint; GitHub publishes the fingerprints here, check one, type yes. Then you should see Hi ada! You've successfully authenticated. From now on, clone with the SSH address GitHub shows under the green Code button, the one that starts git@github.com:, and you will never type a password to push.
Signing your commits
Anyone can set user.name to your name. A signature on a commit proves it was made with a key only you hold, and GitHub shows a green Verified badge next to signed commits. Since Git 2.34 the SSH key you just made can sign too, so there is nothing else to generate:
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
The last line signs every commit without you thinking about it. Then upload the same public key a second time to GitHub, this time choosing the signing key type in the Key type dropdown; GitHub treats authentication and signing as separate uses and says so: “upload that same key again for use as a signing key.” Once it is there, every commit you push shows a green Verified badge, because GitHub checks the signature against the key on your account. (I verified the signing locally while writing this, as below; the badge itself you will see on your first push.)
Locally, git can check its own signatures once it knows which keys belong to which emails. One line in a file does it:
echo "ada@example.com $(cat ~/.ssh/id_ed25519.pub)" >> ~/.ssh/allowed_signers
git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers
git log --show-signature -1
commit e43e57f347a816f4168606821448b1c7d897c3a7
Good "git" signature for ada@example.com with ED25519 key SHA256:SuAUnR3jMGCBPdoURwEhgkXaa/PFRbKG2kA2Z2j9O2M
Author: Ada Gopher <ada@example.com>
Date: Sun Oct 18 08:00:00 2026 -0400
First signed commit
Why bother, on a personal project? Because chapter 6 lets you tell GitHub to refuse unsigned commits on main, and because the day someone asks “did you really push this?” the answer is a badge rather than a shrug.
Files that should never be in any repository
Every operating system and editor litters folders with files that are nobody’s business: .DS_Store on macOS, Thumbs.db on Windows, .vscode/ and .idea/ from editors, *.log from everything. Each project has its own .gitignore (chapter 3), but these belong in a global one so you never have to think about them again:
git config --global core.excludesFile ~/.gitignore_global
Then put this in ~/.gitignore_global:
*.log
.DS_Store
Thumbs.db
.vscode/
.idea/
Create a stray debug.log in any repository and git status will not even mention it.
Read what you did
cat ~/.gitconfig
[user]
name = Ada Gopher
email = ada@example.com
signingkey = ~/.ssh/id_ed25519.pub
[init]
defaultBranch = main
[core]
editor = code --wait
excludesFile = ~/.gitignore_global
[gpg]
format = ssh
[commit]
gpgsign = true
Ten lines. That is the entire setup, it is plain text, and you can copy it to the next machine. The two things in your home folder that are secret are the private key and, after chapter 9, nothing else.
On Windows, one more line saves a surprise: git config --global core.autocrlf true lets you work with Windows line endings while the repository keeps the Unix ones everyone else uses.
Conclusion
Name and email, main by default, an editor you can exit, an SSH key for pushing and signing, a global ignore file. Done once, it holds for years. Next: the loop you will run many times a day.