Setup GPG in Git environment
Setting Up Git Environment and Signing Git Commits with GPG
Git is a powerful version control system, and signing commits with GPG adds an extra layer of security and authenticity to your work. This blog post will guide you through setting up your Git environment and configuring GPG for signing commits.
Step 1: Install Git
Before configuring Git, ensure it is installed on your system. You can install Git using the following commands based on your operating system:
- Ubuntu/Debian:
1
sudo apt-get install git-core
- CentOS/Red Hat:
1
sudo yum install git-core
- Windows: Download and install Git from the official website, then verify installation using:
1
git --version
Step 2: Install GPG
Install GNU Privacy Guard (GPG) to generate and manage cryptographic keys. Verify installation in your terminal using:
1
gpg --version
Step 3: Generate or List GPG Keys
If you don’t have a GPG key yet, generate one using:
1
gpg --full-generate-key
To list existing secret keys, run:
1
gpg --list-secret-keys --keyid-format=long
This will display your keys in the format:
1
2
sec 4096R/ [expires: ]
uid Your Name
Copy the long key ID (e.g., ABCDEF1234567890) for use in the next steps.
Step 4: Configure Git to Use Your Signing Key
Set up Git environment to use your GPG key for signing commits:
- Unset any previously configured
gpg.format:1
git config --global --unset gpg.format
- Specify the GPG program path:
- On Linux, MacOS or other UNIX operating systems:
1
git config --global gpg.program gpg - On Windows:
1
git config --global gpg.program "C:\Users\suriyaa\AppData\Local\Programs\GnuPG\bin\gpg.exe"
Replace
suriyaawith your Windows username.
- On Linux, MacOS or other UNIX operating systems:
- Set your signing key globally:
1
git config --global user.signingkey <keyID> - Enable commit signing by default:
1
git config --global commit.gpgsign true
- Enable tag signing by default:
1
git config --global tag.gpgSign true
Step 5: Sign Commits
You can now sign commits manually or automatically:
- Manually sign a commit:
1
git commit -S -m "Your commit message"
- Automatically sign all commits (enabled in Step 4).
Step 6: Verify Signed Commits
To verify that your commits are signed, use:
1
git log --show-signature
This will display details about the signature, such as:
1
2
gpg: Signature made using RSA key ID ABCDEF1234567890
gpg: Good signature from "Your Name"
Step 7: Add Your GPG Key to GitHub/GitLab
To ensure your signed commits are verified on platforms like GitHub or GitLab:
- Export your public GPG key:
1
gpg --armor --export
- Copy the output and add it to your account on GitHub or GitLab under “SSH and GPG Keys”.
Conclusion
By following these steps, you can securely sign and verify your Git commits, enhancing trust in collaborative projects!