Sign Your Git Commit with GPG Key.md

Sign Your Git Commit with GPG Key.md

Sign Your Git Commit with GPG Key

"Why do I need to sign my git commit?":

• Authentication: verifies that one is responsible for the commit.
• Integrity: create a commit signature that detects post-commit modification.
• Non-repudiation: prevents one from denying authorship of who signed the commits.
• Attack mitigation: prevents spoofing.

Prerequisites:

• A computer with operating system.
• A basic git knowledge, check Wikipedia Git or man git.
• An email address that is used in a git hosting site.

Table of Contents:

1. Create Your GPG Key
2. Put It on git config and Your git Hosting Platform
3. Sign Your git commit

1. Create Your GPG Key

Windows: gpg4win Most Linux systems would have gpg already installed. If not, you have to install it with your specific distribution package manager.

1) Command to Fully Generate a Key Pair to Use

gpg --full-gen-key

---

Please select what kind of key you want:
   (1) RSA and RSA
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (9) ECC (sign and encrypt) *default*
  (10) ECC (sign only)
  (14) Existing key from card
Your selection?

Go with the default, it's the most secure and featureful (press enter).

---

Please select which elliptic curve you want:
   (1) Curve 25519 *default*
   (4) NIST P-384
   (6) Brainpool P-256
Your selection?

Go with the default, it's the most secure (press enter).

---

Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0)

Go with the default (press enter), unless you want the hassle of creating new gpg key from time to time. And then press y and enter to confirm your choice.

---

GnuPG needs to construct a user ID to identify your key.

Real name: Gregory Watson III
Email address: gregthird@watson.co.uk
Comment:
You selected this USER-ID:
    "Gregory Watson III <gregthird@watson.co.uk>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit?

Fill up the information, especially the email address, you can match your real name to your set email address fulll name. Type O and then enter.

It will prompt you to enter a secure password and repeat it to confirm. You have to put a secure one and remembers it.

---

2. Put It on git config and Your git Hosting Platform

1) Adding it to git config

If you only have one git hosting site account:

git config --global user.name "Gregory Watson III"

git config --global user.email gregthird@watson.co.uk

git config --global user.signingkey gregthird@watson.co.uk

If you only have more than one GPG, by that means other git hosting site accounts:

In your directory of cloned remote git repository:

git config user.name "Gregory Watson III"

git config user.email gregthird@watson.co.uk

git config user.signingkey gregthird@watson.co.uk

You can adjust the rest of the guide to your condition.

2) Set commit.gpgsign to true

git config --global commit.gpgsign true

3) Check Your Whole git config

git config --global --list

Your git config should be something like this:

user.name=Gregory Watson III
user.email=gregthird@watson.co.uk
user.signingkey=gregthird@watson.co.uk
commit.gpgsign=true

4) Put it on Your git Hosting Platform.

On GitHub: Your Avatar > Settings > SSH and GPG keys > New GPG key

You can check the Flag unsigned commits as unverified option in Vigilant mode, "This will include any commit attributed to your account but not signed with your GPG or S/MIME key. Note that this will include your existing unsigned commits."

On Codeberg: Your Avatar > Settings > SSH / GPG keys > Add key

You can verify your newly added GPG key with Codeberg's key verification method.

---

3. Sign Your git commit

1. Make changes to your git repository contents.

2. git add Assuming you already in your working repository:

git add .

2. git commit Commit with -S option

git commit -S -m "<your message>"

You will be prompted to fill your GPG key password once per your machine boot.

3. git push

git push

Adjust it to your specific options of git push