Signing Commits in Git

This is a step by step tutorial on how signing commits in git.

Step 1: Key Management

to check all the installed keys

List the installed keys

				
					$gpg --list-keys

you will get an output such as this

				
					pub   rsa3072 2024-09-06 [SC]
      B8123D271E29EF454E54CE73904E69AEDC24624E
uid           [ultimate] Habibur Rahman <accounts@emon.no>
sub   rsa3072 2024-09-06 [E]

#the <key-id> in this case is B8123D271E29EF454E54CE73904E69AEDC24624E

Delete existing key and secret key (optional)

				
					$gpg --delete-secret-key <key-id>
$gpg --delete-key <key-id>

Step 2: Create a new key

Generate a new key

				
					$gpg --full-generate-key

Choose the key type

You will be prompted to select the kind of key you want. Choose the kind of key.

				
					Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
  (14) Existing key from card

Note: GitHub accepts RSA, hence you can choose the (default)

Choose the key size

Next it will prompt you to enter the keysize. Enter the value
Note: GitHub recommends 4096 bits long

Choose the key validity period

next it will prompt you to specify the validity period of the key. Enter a desired value

0 = key does not expire

<n> = key expires in n days

<n>w = key expires in n weeks

<n>m = key expires in n months

<n>y = key expires in n years

Note: GitHub recommends to enter 0 = key does not expire

Enter personal details

GPG will then promt your Real name, email, and a comment. Fill them as requested

Enter passphrase

It will then ask for a passphrase to protect the new key. Enter a passphrase and remember it. It will ask you to repeat the pass phrase

Key generation complete

Your key is now generated. You can check for the key using this command

				
					$gpg --list-keys

Step 3: Create a secret key

to view the secret key

				
					$gpg --list-secret-keys --keyid-format=short

				
					sec   rsa4096/FB02FDC3 2024-09-06 [SC]
      8F3AC39235D25714A4F141E14821DBE9FB02FDC3
uid         [ultimate] Habibur Rahman <accounts@emon.no>
ssb   rsa4096/743EF7A4 2024-09-06 [E]

To view the key-id in the long format

				
					$gpg --list-secret-keys --keyid-format=long

				
					sec   rsa4096/4821DBE9FB02FDC3 2024-09-06 [SC]
      8F3AC39235D25714A4F141E14821DBE9FB02FDC3
uid                 [ultimate] Habibur Rahman <accounts@emon.no>
ssb   rsa4096/AA50607A743EF7A4 2024-09-06 [E]

the <full-fingerprint> is 8F3AC39235D25714A4F141E14821DBE9FB02FDC3

the <long-form-key-id-pub> is 4821DBE9FB02FDC3

the <long-form-key-id-sub> is AA50607A743EF7A4

the <short-form-key-id-pub> is FB02FDC3

the <short-form-key-id-sub> is 743EF7A4

# the <key-id> which we will use can either be:

<full-fingerprint>

<long-form-key-id-pub>

<short-form-key-id-sub>

Export the GPG key

To export the user’s secret (private) GPG key in ASCII-armored format, use the command below where the <key-id> can be <full-fingerprint>, <long-form-key-id-pub> or <short-form-key-id-sub>

				
					$gpg --armor --export <key-id>

#you will get a public key output like this

This is the key that you need to register in your GitHub account, which will be discussed later.

Step 4: Configuring Git to use the signed keys

check the global git configuration values

				
					$git config --global --list

(optional) delete a specific global configuration

				
					$git config --global --unset <entry>

For example to deltete user.email, use git config –global –unset user.email

if there are multiple instances of an entry, use the command

				
					$git config --global --unset-all user.email

Configure signing key

the following entries are needed to configure GPG with GitHub apart from the “user.name” and “user.email”

in our example, the command should be

$git config –global user.signingkey 8F3AC39235D25714A4F141E14821DBE9FB02FDC3

you can also use the long or short or the full form, i.e. , or . Doesnt matter 🙂

				
					$git config  --global user.signingkey <key-id>

Enable the gpg sign commig and gpg sign on tags

				
					$git config --global commit.gpgsign true
$git config --global tag.gpgsign true

Configure GPG environment path

for linux:

				
					$git config --global gpg.program gpg

for windows:

				
					$git config --global gpg.program "C:\Program Files (x86)\GnuPG\bin\gpg.exe"

for MacOS:

				
					$git config --global gpg.program=/opt/homebrew/bin/gpg

if you want to find the path of gpg, you can find it using

				
					$which gpg

Verify git configuration

				
					$git config --global --list

				
					user.name=John Doe
user.email=john@dope.com
user.signingkey=8F3AC39235D25714A4F141E14821DBE9FB02FDC3
gpg.program=gpg
commit.gpgsign=true
tag.gpgsign=true

Export GPG TTY

				
					$export GPG_TTY=$(tty)

Share the Post:

Emon