Why Digital Signatures Are Needed

If you don't digitally sign, anyone can forge your Commit by simply changing their own Email address on their computer. This is extremely dangerous.

file

Understanding GPG Signatures

Git commits must be digitally signed using GPG.

GPG signing is a type of digital signature used to prove the authenticity and integrity of an electronic document or file. GPG stands for GNU Privacy Guard, an open-source encryption software that can be used to create and verify digital signatures. A GPG signature is generated by encrypting the file's hash value with the sender's private key. The recipient can then use the sender's public key to verify the signature, ensuring that the file has not been tampered with and was indeed sent by the sender. GPG signatures are commonly used to protect sensitive information and ensure the integrity of electronic documents.

Download and Install GPG

If you are using Linux or macOS, you can use your package manager to install it.

If you are using Windows, you can download and install the installer from the Gpg4win official website; or install Git + GitBash.

Generate a Key

Enabling GPG Sign is very simple.

First, generate a Key:

gpg --gen-key

During the process above, gpg will ask for your name and email address, and also require you to set a passphrase.

Get My Key ID

After completion, you can use the following command to list your GPG keys:

gpg --list-secret-keys --keyid-format LONG

You need to find the ID of the key that was just generated. It is usually an 8-character hexadecimal string.

file

Configure Git Commit to Use This Key

Use the command to set the Key used for GIt Commit:

git config --global user.signingkey $signKey

In the example above, $signKey should be the Key ID you just copied.

You may want Git to automatically sign every commit. Run the following command to enable automatic signing by default:

git config --global commit.gpgsign true

All set, go ahead and try creating a commit using your preferred editor. You will see it in git log:

git log -1 --show-signature

file

Make GitHub and GitLab Trust Your Public Key

Obviously, hackers can also impersonate you to complete the steps above. Simply completing the steps above only signs the Commit. For final security protection, the platform must trust your signature (public key). This way, as long as hackers cannot access your private key, they will not be able to generate a Commit trusted by the platform.

To complete this step, you need to add the public key to your GitHub account. You can use the following command to export your public key:

gpg --armor --export $signKey

In the example above, $signKey should be the Key ID you just copied. This will output your public key, which you can copy and paste into the GPG key section of your GitHub/GitLab account settings.

file

Note: Your public key is intended to be public and should be displayed as widely as possible. There is no need to worry about it being leaked; in fact, you should share it with your friends as your public key.

Give it a try!

At this point, your Git commits will be shown as trusted, and will no longer be impersonated by hackers.

file

Sync Your Key Across Devices

I understand that many of you now have a lot of electronic devices. Manually setting up this Key on each of your computers is very tedious.

A simpler approach is to simply store your GPG Key and SSH Key in cloud storage. Of course, this introduces security risks: the cloud storage provider will have access to your Key. Furthermore, if a hacker compromises your cloud storage, they could forge all of your Commits. (However, if your Key is password-protected, they would still be unable to use it.)

If you believe that sacrificing a little security for convenience is worth it, you can synchronize your Key across devices. Here, I will use Nextcloud as an example:

First, export your Key. This step is very simple:

SIGNKEY=$(gpg --list-secret-keys --keyid-format LONG | grep sec | awk '{print $2}' | awk -F/ '{print $2}')
gpg --export-secret-keys $SIGNKEY > private.key

This will export your key to a file: private.key. Copy this file to your cloud storage.

Create a new folder in Nextcloud and place your GPG Key and SSH Key inside.

file

For a new computer, you can run the following Bash script to import your key: (Bash syntax. May not run directly in PowerShell on Windows)

# SSH Keys
echo "Setting SSH keys..."
mkdir ~/.ssh
cp -r ~/Nextcloud/Storage/SSH/* ~/.ssh/
chmod 644 ~/.ssh/id_rsa.pub
chmod 600 ~/.ssh/id_rsa

# GPG Keys
echo "Setting GPG keys..."
sudo rm ~/.gnupg -rf
mkdir ~/.gnupg
gpg --import ~/Nextcloud/Storage/GPG/private.key
chmod 700 ~/.gnupg
SIGNKEY=$(gpg --list-secret-keys --keyid-format LONG | grep sec | awk '{print $2}' | awk -F/ '{print $2}')
git config --global user.signingkey $SIGNKEY
git config --global commit.gpgsign true

Every time you get a new computer, after installing Nextcloud, just run the script above to configure the SSH and GPG environment with a single click. After that, use SSH and Git features as usual, and you'll enjoy a secure and hassle-free experience!

Note: Be sure to prevent hackers from accessing your GPG private key! Enable 2FA on your cloud storage and use a GPG password to enhance security!

Final Step: Call Your Friends!

Of course, once you have configured GPG signing, the final—and most important—step is this: send your public key to your friends and tell them to trust it! Otherwise... if readers don't know how to properly verify signatures, enabling GPG is no different from not using it at all...