Skip to content

20. Managing GitHub commit signature verification

Jump to bottom
Janemesi edited this page Oct 22, 2025 · 3 revisions

To get commits signed (and showing as verified on GitHub) on Windows 10 x64:

  • Install the latest version of GPG with winget: C:\> winget install GnuPG.GnuPG

  • Verify the installation with: C:\> gpg --version

  • Generate GPG key C:\> gpg --full-generate-key

  • Use your full name and e-mail. These should match name/email pair used in the GitHub account.

The key must be at least 4096 bits.

  • Export the key in ASCII armor format

  • List the short key:

C:\> gpg --list-secret-keys --keyid-format=long sec rsa4096/[short-key] 2021-06-14 [SC]

  • Use the short key to export the public key:

C:\> gpg --armor --export [short-key]

  • Copy the key including the BEGIN/END text.

-----BEGIN PGP PUBLIC KEY BLOCK-----

[huge-ascii-key]

-----END PGP PUBLIC KEY BLOCK-----

  • On GitHub, Add the GPG armor ASCII key to your GitHub account:

Go to Profile > Settings > SSH and GPG keys > New GPG key

image

image

image

  • On your PC, configure Git to sign all commits by default

C:\> git config --global user.signingkey [short-key]

C:\> git config --global commit.gpgsign true

C:\> git config --global gpg.program "C:/Program Files (x86)/gnupg/bin/gpg"

  • Set GPG environment variable for the GPG Agent Verify GPG agent installation: gpg-agent --version

Set the environment variable: GNUPGHOME=%USERPROFILE%\AppData\Roaming\gnupg

  • The resulting .gitconfig would have the user section like so: [user]

name = Your Name

email = your@email.com

signingkey = [short-key]

[commit]

gpgsign = true

[gpg]

program = C:/Program Files (x86)/gnupg/bin/gpg

Common Errors

  • Signing failed: No secret key

gpg: keyblock resource 'C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming\\gnupg\\pubring.kbx': No such file or directory

gpg: skipped "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx": No secret key

gpg: signing failed: No secret key

error: gpg failed to sign the data

fatal: failed to write commit object

  • Run: gpg-agent --daemon to restart GPG Agent
  • If the solution above does not work, note the path of the keyblock resource, it consists of two paths and is indeed not valid.
  • To solve this: git config --global --replace-all gpg.program "C:\Program Files (x86)\GnuPG\bin\gpg.exe"

Security, Access, Deployment, And Data Flows

Clone this wiki locally