How to Sign Our Git Commits with GPG

How to sign a git commit: In this post, we talk about how to use GPG to sign a Git commit.

May 20, 2022 2 min read

Hello!

Today, let’s talk about signing a git commit with GPG, an encryption engine for signing and signature verification.

When it comes to work across the Internet, it’s recommended that we add a cryptographic signature to our commit, which provides some sort of assurance that a commit is originated from us, rather than from an impersonator.

This blog is based on the following environments:

Windows 10 x64-based
Ubuntu 20.04 LTS, Windows Subsystem Linux (WSL) version 2

In this section, we will install GPG, and config it.

$ sudo apt-get install gnupg

And it’s done. Next, we have to configure it.

Firstly, we will append these two lines to the profile file. In this case, I am using bash. So I will open ~/.bashrc, and append:

export GPG_TTY=$(tty)
gpgconf --launch gpg-agent

After saving these contents, we will go to the terminal, and type this command to validate settings:

$ source ~/.bashrc

And the GPG is ready to go.

Just type this command:

$ gpg --full-gen-key

Note:

What kind of key you want: RSA and RSA (default)
What keysize do you want: 4096
How long the key should be valid: 0 (key does not expire)
Is this correct: Y
Real Name: (Your GitHub Name)
E-mail: (Your GitHub Email), and it MUST MATCH your GitHub account !!!
Comment: (Leave your note for that key)

Now that the keys are generated, we need to add the Public Key to GitHub Setting pages.

To fill in the contents, we go back to the Terminal, and type these commands to get GPG Public Key:

# (1) List all the keys
$ gpg --list-secret-keys --keyid-format=long

# And it shows the following contents: (* hidden for privacy)
#    sec   rsa4096/********** 2022-05-20 [SC]
#          ED0BEFAC1E5C4681F0A0FEF0E97461039812B753
#    uid                 [ultimate] Mighten Dai <mighten@outlook.com>
#    ssb   rsa4096/********** 2022-05-20 [E]

# (2) Display the associate Public Key
$ gpg --armor --export ED0BEFAC1E5C4681F0A0FEF0E97461039812B753 # copy from above

and this command will shows the required Public Key like that:

-----BEGIN PGP PUBLIC KEY BLOCK-----

.........
-----END PGP PUBLIC KEY BLOCK-----

In SSH and GPG Keys of your GitHub Settings, click New GPG Key, and it prompts Begins with '-----BEGIN PGP PUBLIC KEY BLOCK-----', which exactly is the contents above.

In Section 2.2, my Private Key shown as ‘ED0BEFAC1E5C4681F0A0FEF0E97461039812B753’, so I just open the configuration file ~/.gitconfig and change the following properties:

[user]
    name = Mighten Dai
    email = mighten@outlook.com
    signingKey = ED0BEFAC1E5C4681F0A0FEF0E97461039812B753
[commit]
    gpgsign = true
[gpg]
    program = /usr/bin/gpg

And it’s done.

$ git add .
$ git commit -S -m "This is a commit with PGP Signature"

In this section, we talk about other usage of GPG

If you just want to sign a plaintext, you just type with a Pipe command | like this:

echo "Signing a plaintext" | gpg --clearsign

and it immediately shows:

And if some guy send you these thing, you can verify by:

$ gpg --verify signedMsg.txt
gpg: Signature made Fri May 20 15:51:09 2022 CST
gpg:                using RSA key ED0BEFAC1E5C4681F0A0FEF0E97461039812B753
gpg: Good signature from "Mighten Dai <mighten@outlook.com>" [ultimate]

It seems that this message is good. What if we want to tamper with this message

$ gpg --verify signedMsg-tampered.txt
gpg: Signature made Fri May 20 15:51:09 2022 CST
gpg:                using RSA key ED0BEFAC1E5C4681F0A0FEF0E97461039812B753
gpg: BAD signature from "Mighten Dai <mighten@outlook.com>" [ultimate]

So, now we can see the bad message detected.

In this section, I will verify the integrity of online files.

I have downloaded the file gnupg-2.4.2.tar.bz2.sig and its signature file gnupg-2.4.2.tar.bz2, I can verify by:

# 1. acquire Public Key of the publisher,
#      e.g., https://gnupg.org/signature_key.html
$ gpg --import  public_key.asc
...
gpg: Total number processed: 4
gpg:               imported: 4
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u

# 2. verify the file
$ gpg --verify gnupg-2.4.2.tar.bz2.sig  gnupg-2.4.2.tar.bz2
gpg: Signature made 5/30/2023 8:27:44 PM China Standard Time
gpg:                using EDDSA key 6DAA6E64A76D2840571B4902528897B826403ADA
gpg: Good signature from "Werner Koch (dist signing 2020)" [unknown]
...

# 3. List all the keys
$ gpg --list-keys

# 4. Delete keys that are temporarily imported
$ gpg --delete-key  < The keyID you want to delete >