[38;5;244m┌─[0m [38;5;40mroot@joaocosta:~#[0m [38;5;245mcat posts/11.md[0m [38;5;244m───────────────────────────────────────────[0m

[38;5;40m#[0m [1mSigning commits in git[0m
[38;5;245mpublished 2022-05-10 · 1 min read · https://joaocosta.dev/blog/11[0m

Quick PSA about signing git commits.

In GitLab and GitHub, you can now add a GPG key to your account. If you have a
GPG key, the commits you sign will appear as [38;5;38mverified[0m: provides extra assurance
that a commit originated from you, and not from an impersonator. It is also
possible for repo owners to reject unsigned commits.

[38;5;38m##[0m [1mGenerate a key[0m

Generating a key is as easy as running one of following, and answering the
questions:

[38;5;40m→[0m [38;5;38mgpg --gen-key[0m;
[38;5;40m→[0m [38;5;38mgpg --full-gen-key[0m - more (advanced) options.

[38;5;38m##[0m [1mFind your key[0m

If you run [38;5;38mgpg --list-keys <EMAIL>[0m, where [38;5;38m<EMAIL>[0m is the e-mail address you used
to create the key, you'll be able to see the ID of your key. For example:

[38;5;244m┄────────────────────────────────────────────────────────────────────────── sh [0m
[38;5;245m│[0m > gpg --list-keys joaocosta.work@posteo.net
[38;5;245m│[0m pub   rsa4096 2022-05-04 [SC]
[38;5;245m│[0m       ABCDEF9876543210FEDCBA0123456789ABCDEF12
[38;5;245m│[0m uid           [ unknown] João Costa (Git commit signing key) <joaocosta.work@posteo.net>
[38;5;244m┄──────────────────────────────────────────────────────────────────────────────[0m

The key ID is [38;5;38mABCDEF9876543210FEDCBA0123456789ABCDEF12[0m

[38;5;38m##[0m [1mExporting the key[0m

With [38;5;38mgpg --armor --export <ID>[0m, where [38;5;38m<ID>[0m is the ID of your key, you can export
your public key. Copy this to your [38;5;40mGitLab[0m
[38;5;244m(https://gitlab.com/-/profile/gpg_keys)[0m/ [38;5;40mGitHub[0m
[38;5;244m(https://github.com/settings/gpg/new)[0m account.

[38;5;38m##[0m [1mConfig git[0m

You can add the following to your git config to automatically sign commits when
you make them ([38;5;38m<KEY-ID>[0m is the ID of your key):

[38;5;244m┄────────────────────────────────────────────────────────────────────────── sh [0m
[38;5;245m│[0m [user]
[38;5;245m│[0m   signingKey = <KEY-ID>
[38;5;245m│[0m [commit]
[38;5;245m│[0m   gpgsign = true
[38;5;244m┄──────────────────────────────────────────────────────────────────────────────[0m

[38;5;38m##[0m [1mConclusion[0m

Remember:

[38;5;40m→[0m Don't share your private key;
[38;5;40m→[0m If you set a password for your key, you might need to enter if every time you
  commit:
- Search for [38;5;38mgpg caching password[0m.

Stay safe :P

[38;5;244m└─[0m [38;5;40m→[0m view online: [38;5;40mhttps://joaocosta.dev/blog/11[0m