📍Git Commits
Add tamper resistance to repository by signing git commits.
TL;DR
Run these commands if you already have a GPG Key Pair.
# Find your key ID
gpg --list-secret-keys --keyid-format=long# print public key to terminal
gpg --armor --export YourKeyIdRun the following for your preferred shell:
Z Shell
[ -f ~/.zshrc ] && echo 'export GPG_TTY=$(tty)' >> $HOME/.zshrc
echo "alias sign='git commit -s -m'" >> $HOME/.zshrcBash
[ -f ~/.bashrc ] && echo 'export GPG_TTY=$(tty)' >> ~/.bashrc
echo "alias sign='git commit -s -m'" >> $HOME/.bashrcgit config --global commit.gpgsign true
git config --global user.signingkey YOUR-KEY-ID# sign the commit using the gpg
git commit -s -m "your commit message"
# or, optionally use the alias we added to the shell profile
sign "your commit message"Installation Details
Create Your GPG Key Pair
If you have no GPG key, you will need to create one.
Export the Public Key
You'll need to tell GitHub about your credentials which means giving them your public key. To retrieve your key, execute:
gpg --list-secret-keys --keyid-format=longNow print the public key from the previous step to the terminal.
gpg --armor --export ACADE3679FCE5492
Your key will print to the terminal. Copy everything, including -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP PUBLIC KEY BLOCK-----
Add GPG Key to GitHub
GitHub needs to know your public credentials in order to verify each of your signed commits. Follow the steps shown here to add your key to GitHub.
Configure Shell Profile
Let's add two things to execute for each new shell session:
an alias that simplifies signing commits
add your GPG key to the shell environment
Make sure to start a new shell session after you add these!
Configure Git Profile
Tell git you'll be signing commits. Navigate to an existing repository and execute:
Signing Commits
You're ready to start signing your work!
Here's what it looks like to sign a commit:
Last updated