Generating GPG Keys and Signing Commits

#opensource #tooling #privacy #webdev

Generating a GPG key and using it to sign your Git commits is a recommended practice to ensure the authenticity and integrity of your code. In this post, we'll explore the step-by-step process.

1. Installing GPG

First, you need to install GPG (GNU Privacy Guard) on your machine. Depending on your operating system, you can use the following commands:

For Ubuntu/Debian: sudo apt-get install gnupg
For macOS: brew install gnupg
For Windows: Download and install Gpg4win from the official website.

2. Checking Existing Keys

Before generating a new GPG key, it's advisable to check if any existing keys have been generated on your machine. To do this, run the following command:

gpg --list-keys

If no keys are listed, you can proceed to generate a new GPG key.

3. Generating a GPG Key

Once GPG is installed, the next step is to generate a new key. Run the following command in the terminal:

gpg --full-generate-key

You will be prompted to provide some information such as the type of key, size, validity period, name, and email. Follow the on-screen instructions to complete the process.

4. Exporting the Public Key

After generating your key, you will need to export the public key to associate it with your profile on GitHub or another Git service. Use the command below to export your public key:

gpg --armor --export YOUR_KEY_ID

Replace "YOUR_KEY_ID" with the ID of your key, which can be found with the command gpg --list-keys or gpg --list-secret-key --keyid-format LONG.

5. Linking the Key to GitHub

Copy the output of the previous command and go to your account settings on GitHub. In the "SSH and GPG keys" section, add a new GPG key and paste the public key that you copied.

GitHub Docs: Adding a GPG key to your GitHub account

6. Setting Up Git to Use the GPG Key

Now, you need to configure Git to sign your commits with your GPG key. Execute the following commands replacing "YOUR_KEY_ID" with your key ID:

git config --global user.signingkey YOUR_KEY_ID
git config --global commit.gpgSign true

7. Signing Commits

With all configurations completed, you can start signing your commits. When making a commit, Git automatically uses your GPG key to sign it:

git commit -m "Your commit message"

To verify if the commit was signed correctly, you can use the command:

git log --show-signature

Conclusion

Signing your commits with a GPG key is an excellent way to enhance the security and reliability of your code. This guide should help you set up and effectively use GPG keys to sign your commits.