Skip to content

git-gpg.md

Latest commit

 

History

History
49 lines (36 loc) · 1.59 KB

git-gpg.md

File metadata and controls

49 lines (36 loc) · 1.59 KB
Raw

Git commit signing

By default, anyone can make a commit with any email and name set up. To help prevent fraudulent commits, every commit pushed to jank repos must be signed by the author's GPG key. If you already have a GPG key in working order, skip to enable signing. If you already sign your commits, skip to here to verify everything is working.

Generate your key

Follow this Github guide to generate a new key with email address you use for Github and export the key to your Github account.

Enable signing

Every commit must be signed, so it's easiest to just enable signing by default. You can do that with the following:

git config --global commit.gpgsign true

GPG passphrase prompt

If you'd like GPG to prompt you for your passphrase in your terminal, rather than as a GUI popup, you can put this in your ~/.bashrc (or similar):

# Always prompt for GPG password from terminal.
export GPG_TTY=$(tty)

Verifying everything is working

You can download and run the following script to verify your set up is working. Your session should look something like this:

# cd to your ~/projects or whatever directory you use for repos.

$ git clone git@github.com:jank-lang/jank.git
$ cd jank
$ ./bin/verify-git-gpg
gpg: Signature made Tue 17 Apr 2018 02:19:21 PM PDT
gpg:                using RSA key FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
gpg:                issuer "sally@foo.com"
gpg: Good signature from "Sally Dev <sally@foo.com>" [ultimate]