Skip to content
Search

DEV Community

Johan Bové
Johan Bové

Posted on • Originally published at social.johanbove.info on

 

Using Keybase GPG to sign git commits and tags

#git #keybase #pgp

With the Keybase application installed on the "Windows Subsystem for Linux" command line, export the pgp Keybase key and import it into the local gpg keychain:

$ gpg --list-secret-keys --keyid-format LONG
$ keybase pgp pull johanbove
$ git config --global user.signingkey B6A8D5E8
$ keybase pgp export -q 4AAE11D0B6A8D5E8 | gpg --import
$ keybase pgp export -q 4AAE11D0B6A8D5E8 --secret | gpg --allow-secret-key-import --import
$ echo "test" | gpg --clearsign
Enter fullscreen mode Exit fullscreen mode

I also had to add this code into the ~/.bashrc file to make the gpg passphrase prompt work in WSL:

# enable passphrase prompt for gpg
export GPG_TTY=$(tty)
Enter fullscreen mode Exit fullscreen mode

Setting the trust level of the imported key:

$ gpg --list-keys
$ gpg --edit-key E44E71105E920276ED1693294AAE11D0B6A8D5E8
Enter fullscreen mode Exit fullscreen mode

Following the instructions in gpg.

Signing a git tag:

$ git tag -s v1.0.0 -m "Release v1.0.0 signed"
Enter fullscreen mode Exit fullscreen mode

Verifying the git tag:

$ git tag -v v1.0.0
Enter fullscreen mode Exit fullscreen mode

Sources:

Latest comments (1)

DEV Community

Timeless DEV post...

Git Concepts I Wish I Knew Years Ago

The most used technology by developers is not Javascript.

It's not Python or HTML.

It hardly even gets mentioned in interviews or listed as a pre-requisite for jobs.

I'm talking about Git and version control of course.

One does not simply learn git

Read next

saminarp profile image

My Experience With GitHub Topic Branches

Samina Rahman Purba -

kkazala profile image

Azure DevOps pipelines shallow fetch =1 is now default

Kinga -

humbertoa6 profile image

PGP - Encrypt/Decrypt file with Ruby on Rails (Part 3)

Humberto Arroyo -

wadecodez profile image

The Git Commands I Use Every Day

Wade Zimmerman -