GPG
In this post today, we are going to look into the steps that we need to follow to generate and use a gpg key with github
Below given are the steps
Installation
Install GnuPG for windows
Validation of Installation
Run the below command to verify if gpg is installed and working fine
gpg --version
Generate GPG key
gpg --full-generate-key
Running the above command will start running a command line wizard or sequence of steps,
Choose the right length of the key
Provide your username and email address
Also provide a comment (Optional)
Once done, approve with "O"
Then the system will prompt for Key phrase, which will be used to secure the keys, so please remember and provide a secure value
Listing the key
List the keys that were generated as a result of the previous command using the below command
gpg --list-secret-keys --keyid-format=long
This command will produce a similar output
gpg --list-secret-keys --keyid-format=long
--------------------------------
pub 2048R/35F5FFB2 2016-04-23
uid name (New key) <name@mail.com>
sub 2048R/112A8C2D 2016-04-23
In the above output, we have
35F5FFB2 as the [short-key] that will be used in the commands below
Export the key in ASCII armor format
gpg --armor --export 35F5FFB2
This command will produce an output like the one given below
-----BEGIN PGP PUBLIC KEY BLOCK-----
[key]
-----END PGP PUBLIC KEY BLOCK-----
Here, the [key] will be the real key which is used to identify and verify the commits that were signed from the local environment.
Github Add GPG Keys
In order to add the above key to your github account, please follow as per
this linkBasically, the steps are Login to github.com > click on the user profile icon on the top right corner > settings > SSH and GPG keys > Add GPG key > Paste and submit
git configuration
Execute the below given commands to setup the git configuration to use the GPG keys for signing the commits to github
git config --global user.signingkey 35F5FFB2
git config --global commit.gpgsign true
git config --global gpg.program "C:/Program Files (x86)/gnupg/bin/gpg"
In case gpg is installed in a different path, please update the gpg.program value in the last line in the command given above
gpg agent status check
As a last step, ensure that the gpg-agent is up and running by executing the below command
Final .gitconfig verification
In order to verify if the git configurations are rightly applied, find and open the .gitconfig file normally present in the c:\users\username\.gitconfig
The file contents will have values closer to the below given sample
[user]
name = Your Name
email = your@email.com
signingkey = 35F5FFB2
[commit]
gpgsign = true
[gpg]
program = C:/Program Files (x86)/gnupg/bin/gpg
This concludes the configuration. We can validate this by performing below steps
git clone -b <branch_name> <git_url>
update any file
git commit -m "GPG signing validation"
In the above command, if there is no errors, we can can be sure that the gpg configuration is working fine. Post which we can execute the git push command to sync local changes to the server.
In this process, if the gpg-agent needs to be restarted to validate if any errors or to restart for safe running, we can use below command
gpg-connect-agent reloadagent /bye
The above configuration also works with Tortoise git, which I have validated as on date of writing this blog [12th May, 2022]
Comments
Post a Comment