Skip to content

Latest commit

 

History

History
45 lines (37 loc) · 2.25 KB

GPG-Signing-Guide.md

File metadata and controls

45 lines (37 loc) · 2.25 KB
Raw

GPG Signing Guide

Documentation index

Please familiarise yourself with our:

This document explains how to set up GPG Signing on MacOS for Simorgh and its relating projects.

Why?

GPG Signing is an added layer of security to commits. By enforcing a GPG signature on the key, Github verifies that the commits are indeed written by you. (As long as you keep the private side of the key secure) You can also use your GPG key to sign messages, files and even your emails. But for the purpose of this doc we are only interested in commits.

How?

Setting up GPG on a MacOS is actually quite simple. Please follow the links for the detailed documentation given by Github.

  1. Download and install GPG Tools
  2. Uninstall GPG Tools Mail
  3. Open the app and create a new key pair
    • The application will automatically prompt you
  4. Add your public GPG key to GitHub
  5. Tell git about the gpg sign
  6. Turn on commit signing

Automatic Signing

In your local repository you can turn on automatic signing with this command:

git config commit.gpgsign true

If you want git to globally sign all commits that you make use this command:

git config --global commit.gpgsign true

Signing failures

  1. Make sure you follow the following step: https://help.github.com/en/articles/telling-git-about-your-signing-key
  2. Install Pineentry from link or homebrew
brew install pinentry-mac