How to set up git to use the GPG Suite

GPG and git on macOS.md

GPG and git on macOS

Setup

No need for homebrew or anything like that. Works with https://www.git-tower.com and the command line.

1. Install https://gpgtools.org -- I'd suggest to do a customized install and deselect GPGMail.
2. Create or import a key -- see below for https://keybase.io
3. Run gpg --list-secret-keys and look for sec, use the key ID for the next step
4. Configure git to use GPG -- replace the key with the one from gpg --list-secret-keys

git config --global gpg.program /usr/local/MacGPG2/bin/gpg2
git config --global user.signingkey A6B167E1 
git config --global commit.gpgsign true 

1. Optionally configure annotated tags to be GPG signed

git config --global tag.forceSignAnnotated true

1. Add this line to ~/.gnupg/gpg-agent.conf

pinentry-program /usr/local/MacGPG2/libexec/pinentry-mac.app/Contents/MacOS/pinentry-mac

1. Add this line to ~/.gnupg/gpg.conf

no-tty

Keybase.io

Import key to GPG on another host

% keybase pgp export
% keybase pgp export -q CB86A866E870EE00 | gpg --import
% keybase pgp export -q CB86A866E870EE00 --secret | gpg --allow-secret-key-import --import

Add public GPG key to GitHub

% open https://github.com/settings/keys
% keybase pgp export -q CB86A866E440EE00 | pbcopy

See Also

• https://github.com/pstadler/keybase-gpg-github
• /usr/local/MacGPG2 -- this is where MacGPG binaries live
• https://gpgtools.org
• https://www.git-tower.com

For anyone else having this issue after following the directions:

error: gpg failed to sign the data
fatal: failed to write commit object

You need to remember to restart the gpg-agent - running this will kill the agent and start next time it is needed:

$ gpgconf --kill gpg-agent

@sarkis Thanks, restarting was the missing step for me

Works like a charm! Thanks!

Thank you 👍

Thanks a lot

👍

@sarkis Thanks for the restart.

👍

Initially, brew install gpg. But I had to undo this.
Then I installed gpg as instructed above.
Works perfectly now. Thank you so much!

I wonder though... I never had this problem and I don't know git is complaining about 'cannot run gpg...'.
I remember the only thing I did differently before all these happened was that I configured my dotfiles to change the way my terminal looks -- github.com/mathiasbynens/dotfiles
Can anyone say to have done the same? Because in a new (factory reset) laptop and a fresh installed git I believe you won't run into this problem.

Thanks very much. This tutorial works flawlessly on 10.15.6 on a fresh install.
Now I can finally commit from Terminal, Fork & Xcode and everything is signed.

If you use Homebrew, and prefer a leaner installation (GPG Suite comes with a bunch of tools you don't need), it suffices to run

brew install gpg
brew install pinentry-mac

If you have a standard Homebrew installation, and /usr/local/bin is on your PATH, then the only configuration options you need to do are

git config --global user.signingkey <key>
git config --global commit.gpgsign true

Then the line you need to add to ~/.gnupg/gpg-agent.conf is

pinentry-program /usr/local/bin/pinentry-mac

Those who are struggling after this command --> git config --global gpg.program /usr/local/MacGPG2/bin/gpg2 ,

1. Try typing which gpg on command line to get the path like this:

/usr/local/bin/gpg

2. Use output to re-run the command: git config --global gpg.program /usr/local/bin/gpg

thanks! works great (macOS big Sur / github desktop 2.6)

gpgconf --kill gpg-agent

This works for me. I completely forgot about restarting it. Thanks :)

It appears in Homebrew new directory is /opt/homebrew/bin/pinentry-mac

2. git config --global gpg.program /usr/local/bin/gpg

Working. Thanks

If you have already followed the instructions on Git to Generate a new GPG key, and you now want to use GPGTools to manage your key in the keychain, you can use this command to export from gpg (which GnuPG uses) and into gpg2 (which GPGTools uses).

> gpg --list-secret-keys
[keyboxd]
---------
sec   rsa4096 2023-09-16 [SC]
      YOUR_SECRET_KEY_ID
uid           [ unknown] Joe Bloggs <[email protected]>

> gpg --export-secret-key <YOUR_SECRET_KEY_ID> | gpg2 --import

After running command you will see the key imported into GPG Keychain UI with type sec/pub. I was then able to sign commits automatically via pinentry without entering a password (such as on Github Desktop).

source: https://unix.stackexchange.com/questions/481939/how-to-export-a-gpg-private-key-and-public-key-to-a-file