Skip to content

github_ssh_signing_key.md

Latest commit

 

History

History
167 lines (108 loc) · 5.78 KB

github_ssh_signing_key.md

File metadata and controls

167 lines (108 loc) · 5.78 KB
Raw

GitHub Authentication - GitHub SSH Keys (Signing Key)

NOTE: If you came from the GitHub SSH Keys (Authentication Key) guide, proceed from the following step.

NOTE: You can use your SSH key generated in the previous tutorial to sign commits.

Set up SSH keys

Generating a new SSH key:

ssh-keygen -t ed25519 -C "your_email@example.com"

NOTE: You can press enter for all prompts or configure it your way.

Add private key to the authentication agent:

ssh-add

NOTE: This step is a reference to that point in the github documentation.

Check your ~/.ssh directory:

ls -lthr ~/.ssh

You should see these two files:

id_ed25519.pub
id_ed25519

The id_ed25519.pub is your public key, this is the key that must be defined in your Github Settings / SSH and GPG keys.

The id_ed25519 is your private key, once generated, you should not take any action on it, just keep it safe.

Add SSH key in GitHub account - Signing Key

Once the new SSH keys are generated, you can add them to your Github account in the following ways:

Using GitHub web browser

Go to SSH and GPG keys in Github Settings panel:

new-ssh-key

Within the Keys panel, click in New SSH key to create a new key:

add-new-ssh-key-signing-key

  • In the Title field add a name for your SSH key, I recommend something similar to this:
 Github SSH Signing Key

NOTE: This tip is optional, you can put it in the title you want, I just highlight the key type, since Authetication Key and Signing Key are different things within the Github authentication scopes.

  • In the Key Type field, select Signing Key.

  • In the Key field, add the value of ~/.ssh/id_ed25519.pub, which is something like this:

Run:

cat ~/.ssh/id_ed25519.pub

Public key output example:

ssh-ed25519 XXXXX your_email@example.com

NOTE: In the Key field we always put the value of the public key, it's something a little confusing, but it's well documented.

Using GitHub CLI

Commit Signature Verification

You can sign commits and tags locally, to give other people confidence about the origin of a change you have made. If a commit or tag has a GPG, SSH, or S/MIME signature that is cryptographically verifiable, GitHub marks the commit or tag "Verified" or "Partially verified."

Telling Git about your SSH key

This step is related to the following github documentation.

Open terminal and run the following commands for setup git sign commit via SSH key:

git config --global user.name "Your Name"

git config --global user.email "your_email@example.com"

# Configure Git to use SSH to sign commits and tags.
git config --global gpg.format ssh

# To sign all commits by default
git config --global commit.gpgsign true

# To set your SSH signing key in Git.
git config --global user.signingkey ~/.ssh/id_ed25519.pub

NOTE: Take this into account.

git-ssh-sign-verify-warn

If you currently have a git version less than 2.34 this
type of commit signature verify (SSH) will not work, you
must upgrade to version 2.34 or later.

After setting the Git configuration, you can list your defined variables with the following command:

git config --global --list

Git config example output:

user.name="Your Name"
user.email=your_email@example.com
user.signingkey=/path/to/.ssh/id_ed25519.pub
gpg.format=ssh

Signing commits

This step is related to the following github documentation.

You can sign commits locally using GPG, SSH, or S/MIME.

To sign commits, run:

git add .

git commit -S -m "YOUR_COMMIT_MESSAGE"

# Short command
git commit -a -S -m "YOUR_COMMIT_MESSAGE"

You should see the following tag in your web browser commit history:

sign-commit-verified-tag

NOTE: It is important that your user.name and user.email are correctly configured, otherwise you will see the following tag when signing a commit:

sign-commit-unverified-tag

GitHub full guides: