Github verify sign commits
description
This is a guide to verify signed commits on Github.
What is GPG?
GPG, or GNU Privacy Guard, is a public key cryptography implementation. This allows for the secure transmission of information between parties and can be used to verify that the origin of a message is genuine.
Why sign commits?
Signing commits enables other people to verify that commits come from a trusted source and haven't been altered after they were signed. Git uses GPG keys to sign commits and tags.
How to sign commits?
You can sign commits and tags using GPG keys.
How to verify signed commits?
You can verify signed commits and tags using GPG keys.
Steps
Download and install GPG for windows
Create GPG Key
gpg --full-generate-key
List GPG Key with key IDs
gpg --list-secret-keys --keyid-format LONG
Export your public key
gpg --armor --export YOUR-KEY-ID
Add GPG key to Github account
- Copy your GPG key, beginning with -----BEGIN PGP PUBLIC KEY BLOCK----- and ending with -----END PGP PUBLIC KEY BLOCK-----.
- In the upper-right corner of github page, click your profile photo, then click Settings.
- In the user settings sidebar, click SSH and GPG keys.
- Click New GPG key.
- In the "Key" field, paste your GPG key.
- Click Add GPG key.
- Type your GitHub password to verify that it's you.
- Click Confirm.
Configure Git on windows
git config --global user.name "YOUR-NAME"
git config --global user.email "YOUR-EMAIL"
git config --global user.signingkey YOUR-KEY-ID
git config --global commit.gpgsign true
git config --global tag.gpgsign true
git config --global gpg.program "C:\Program Files (x86)\GnuPG\bin\gpg.exe"
List global git config
git config --global --list
Create a signed commit
git commit -S -m "YOUR-COMMIT-MESSAGE"
Create a signed tag
git tag -s v1.0 -m "YOUR-TAG-MESSAGE"
Push signed commits and tags
git push origin master --tags
Verify signed commits and tags
git log --show-signature
Verify signed commits and tags on Github
git log --show-signature --oneline
References
https://help.github.com/en/github/authenticating-to-github/managing-commit-signature-verification
https://help.github.com/en/github/authenticating-to-github/generating-a-new-gpg-key
https://help.github.com/en/github/authenticating-to-github/adding-a-new-gpg-key-to-your-github-account
https://help.github.com/en/github/authenticating-to-github/telling-git-about-your-signing-key
Created with š§” by Supun Nanayakkara