Kitsumed notes on managing .gitconfig configurations & GPG

note.md

This gist is intended as notes for myself, feel free to read them, but it's not here as a tutorial or steps to follow.

Instructions on how to configure git so that it changes the global user commit informations along with the GPG key depending on the parent directory in which the "used git repo" is. (Steps for Windows) This also works when using the Github Desktop App.

Locate .gitconfig file at %userprofile% and add the following config.

# Force usage of GPG key by default globally
[commit]
	gpgSign = true
[tag]
	gpgSign = true

# Configure GPG for programs that does not support it, for exemple, Github Desktop App (Source: https://gist.github.com/BoGnY/f9b1be6393234537c3e247f33e74094a)
[gpg]
  # Path to the GPG app (Need to install GPG4WIN on Windows)
	program = "C:/Program Files (x86)/GnuPG/bin/gpg.exe"

# This is the global commit user information used by git on the whole machine
[user]
	name = Med
	email = 45147847+kitsumed@users.noreply.github.com
  # GPG key ID, can be removed if not signing commits with GPG
	signingkey = <Key ID / Identifiant de Clé here>


# Load the huggingface commit user informations when the repo is inside our designated huggingface directory
[includeIf "gitdir:C:/Users/<username-here>/Documents/HuggingFace/"]
    path = .gitconfig-huggingface

Create a new file .gitconfig-huggingface in the same directory where .gitconfig is located.

[user]
	name = kitsumed
	email = kitsumed@users.noreply.huggingface.co
	# Configure GPG signing key to show verified status
	#signingkey = <Key ID / Identifiant de Clé here>

# Disable usage of GPG key by default
[commit]
	gpgSign = false
[tag]
	gpgSign = false

This config will sign all commits with the GPG key and define user information on username Med & email 45147847+kitsumed@users.noreply.github.com unless the repository used is under C:/Users/<username-here>/Documents/HuggingFace/.

If the repository is under that specific path, the .gitconfig-huggingface is loaded, overwriting values previously defining for the new ones.

Note

In the exemple, gpg is disabled on huggingface, this is one to show how to disable it, and also because as of right now, huggingface does not accept their noreply email as a verified email, thus showing GPG signed commits as unverified.

Tip

You can see what .gitconfig are applyed inside your current repo and in what order using git config --list --show-origin. You can check for valid GPG signatures in your current repo using git log --show-signature.

Tip

When using the Github Desktop app with repository server that are not github.com, for exemple huggingface, you need to go into Github Desktop settings, under advanced and check Use Git Credential Manager. After that, try cloning a repo from the app a popup requesting authentification should apear. Default behavior of git credential mangaer on windows is to save connected accounts informations in Windows Credential Manager system app under the Windows section and they can be managed from there or by using Git Credential Manager commands.

Renewing GPG key & backup private key

https://gist.github.com/TheSherlockHomie/a91d3ecdce8d0ea2bfa38b67c0355d00/07f7a1cb8921eb301cfa4001174c43efcd9554df Note: Can also be done from the Kleopatra UI that comes with GPT4WIN.

Others notes / urls

• https://gist.github.com/Icaruk/f024a18093dc28ec1588cfb90efc32f7/ca5bb461f49be0cac3a06ae272befda4d5bf0be6
• https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key
• https://gist.github.com/nitrocode/bc62b6e86d1bd8c3acf9cb83caab3883/72fe1908c53bed3c00f7e6f372cf6a2ea8636b23
• https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key?platform=windows