This post is a guide to sign Git commits.

macOS

Homebrew

  1. Install gnupg and pinentry-mac.

    1

    brew install gnupg pinentry-mac

  2. Generate a GPG key. You can also refer to the GitHub Docuemnt.

    1

    gpg --full-generate-key
    1. At the prompt, specify the kind of key you want (e.g. RSA (sign only)).
    2. At the prompt, specify the key size (>= 4096) you want (e.g. 4096).

  3. Get the GPG key ID from the output of the following command.

    1

    gpg --list-secret-keys --keyid-format=long

  4. Export the GPG key.

    1

    gpg --armor --export <some GPG key ID>

  5. Add the GPG key to GitHub. You can refer to the GitHub Docuemnt.

  6. Set gpg-agent up.

    1
2

    echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf
killall gpg-agent

  7. Add Git configurations.

    1
2

    git config --global gpg.program gpg
git config --global commit.gpgsign true

  8. Check whether a commit was signed.

    1

    git log --show-signature -1

MacPorts

  1. Install gnupg2 with the pinentry_mac variant.

    1

    sudo port -N install gnupg2 +pinentry_mac

    If MacPorts reports that pinentry-mac requires a full Xcode installation, install its prebuilt package first, then retry:

    1
2

    sudo port -N -b install pinentry-mac use_xcode=no
sudo port -N install gnupg2 +pinentry_mac

    -b allows binary packages only; use_xcode=no bypasses the Xcode check for this installation. This requires an available prebuilt package for your macOS version and architecture. If none is available, install a compatible full Xcode to build pinentry-mac from source.

  2. Follow steps 2 to 5 in the Homebrew section above to generate and add your GPG key to GitHub.

  3. Set pinentry-program in ~/.gnupg/gpg-agent.conf to the MacPorts application path, replacing any existing pinentry-program line:

    1

    pinentry-program /Applications/MacPorts/pinentry-mac.app/Contents/MacOS/pinentry-mac

    Restart gpg-agent:

    1

    killall gpg-agent

  4. Follow steps 7 and 8 in the Homebrew section above to configure Git and check a commit’s signature.

Ubuntu Server (22.04)

  1. Install gnupg.

    1

    sudo apt install gpg

  2. Follow the above steps (described for macOS) from 2 to 5.

  3. Set the environment variable.

    1

    export GPG_TTY="$(tty)"

  4. Add Git configurations.

    1
2

    git config --global gpg.program gpg
git config --global commit.gpgsign true

  5. Check whether a commit was signed.

    1

    git log --show-signature -1