How to Verify Your Commits

Anyone can be anyone when it comes to commits. For example, here is a commit where ""Linus Torvalds"" deletes Linux. I put this document together for myself a while back, but I thought I would share it with other people who want a straightforward guide to setting up commit signing with GPG.

Instructions

1. Install gpg brew install gnupg2 (or sudo apt-get install gnupg2, etc)
2. Generate the key with gpg --full-generate-key (the default type is probably fine)
3. Make sure it is at least 4096 bits
4. Make sure you use your Github no-reply email or an email provided to your Github account.
5. Get the signing key by running gpg --list-secret-keys --keyid-format=long

• In the following list, the signing key is 3AA5C34371567BD2

sec   4096R/3AA5C34371567BD2 2016-03-10 [expires: 2017-03-10]
uid                          Hubot 
ssb   4096R/42B317FD4BA89E7A 2016-03-10

6. Get your public key by running gpg --armor --export YOUR-SIGNING-KEY-HERE | pbcopy
7. Add your gpg key to your Github key settings
8. Turn on Vigilant mode at the bottom of that page.
9. Add your signing key to your Git config git config --global user.signingkey YOUR-SIGNING-KEY-HERE
10. To sign all commits run git config --global commit.gpgsign true
11. Add the GPG export to your zshconfig echo 'export GPG_TTY=$(tty)' >> ~/.zshrc;

For Mac

1. Mac: You can let Keychain manage your pin entry by running brew install pinentry-mac
2. Tell gpg about it with echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf
3. Restart gpg agent killall gpg-agent

Backup Key

1. Export the public key gpg --export -a YOUR-SIGNING-KEY-HERE > gpg-public.asc
2. Export the private key gpg --export-secret-keys -a YOUR-SIGNING-KEY-HERE > gpg-secret.asc
3. You now should have two files gpg-public.asc and gpg-secret.asc in your current directory

Restore Key

1. Import the public key gpg --import gpg-pub.asc
2. Import the secret key gpg --import gpg-sc.asc

References

• Generating a new GPG key
• Adding a new GPG key to your GitHub account
• Enabling Vigilant mode
• Telling Git about your signing key
• Migrate GPG Keys from One Workstation to Another