Last updated March 28, 2021
There are now two ways to approach this:
This Gist explains how to do this using gpg in a step-by-step fashion. Kryptonite is actually wickedly easy to use-but you will still need to follow the instructions
For using a GUI-based GIT tool such as Tower or Github Desktop, follow the steps here for signing with either GPG or Krypt.co.
We use the Homebrew package manager for this step.
brew install gpg2 gnupg pinentry-mac
If this directory does not exist, create it.
# Make the directory
mkdir ~/.gnupg
# The below configuration used to be added within that directory but is no longer required and breaks on M1-based Macs
# echo 'pinentry-program $(brew --prefix)/bin/pinentry-mac' > ~/.gnupg/gpg-agent.conf
If this file does not exist, create it.
# This tells gpg to use the gpg-agent
echo 'use-agent' > ~/.gnupg/gpg.conf
Append the following to your ~/.bash_profile or ~/.bashrc or ~/.zshrc
...
export GPG_TTY=$(tty)
# on the built-in bash on macos use
source ~/.bash_profile
# if using bash through homebrew over ssh use
source ~/.bashrc
# and if using zsh
source ~/.zshrc
You will need to modify the permissions to 700 to secure this directory.
chmod 700 ~/.gnupg
Run the following command to generate your key, note we have to use the --expert flag so as to generate a 4096-bit key.
gpg --full-gen-key
Once you have entered your options, pinentry will prompt you for a password for the new PGP key.
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 3y
Key does not expire at all
Is this correct? (y/N) y
You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <[email protected]>"
Real name: Dr Duh
Email address: [email protected]
Comment:
You selected this USER-ID:
"Dr Duh <[email protected]>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.
# List your keys
gpg -k
Use the next command to generate a short form of the key fingerprint.
Copy the text after the rsa4096/ and before the date generated and use the copied id in step 13:
gpg -K --keyid-format SHORT
sec rsa4096/######## YYYY-MM-DD [SC] [expires: YYYY-MM-DD]
*You need to copy the output from your terminal similar to the example above where the ######## is following the slash. *
In the output from step 10, the line below the row that says 'pub' shows a fingerprint-this is what you use in the placeholder. The output from below is what you copy to Github:
# The export command below gives you the key you add to GitHub
gpg --armor --export <your key id>
git config --global gpg.program $(which gpg)
The below command needs the fingerprint from step 10 above:
git config --global user.signingkey 1111111
This tells Git to sign all commits using the key you specified in step 13.
git config --global commit.gpgsign true
git commit -S -s -m "My Signed Commit"
You will now be prompted by Pinentry for the password for your signing key. You can enter it into the Dialog box-with the option of saving the password to the macOS X Keychain.
Login into Github.com and go to your settings, SSH and GPG Keys, and add your GPG key from the page.
Before you jump on submitting your key to a service such as the MIT PGP Key Server, you should consider the following:
If you have any errors when generating a key regarding gpg-agent, try the following command to see what error it generates:
gpg-agent --daemon
use-standard-socket
# Below option is deprecated
# pinentry-program $(brew --prefix)/bin/pinentry-mac
enable-ssh-support
use-agent
no-tty
gpgconf --reload gpg-agent
Copy the .sh file in this gist to ~/bin/.
Copy the the plist file in this Gist to ~/Library/LaunchAgents/.
Copy the .sh file in this gist to ~/bin/.
Copy the the plist file in this Gist to ~/Library/LaunchAgents/.
| <?xml version="1.0" encoding="UTF-8"?> | |
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | |
| <!-- This needs to be placed at ~/Library/LaunchAgents/org.gnupg.gpg-agent.plist --> | |
| <plist version="1.0"> | |
| <dict> | |
| <key>Label</key> | |
| <string>org.gnupg.gpg-agent</string> | |
| <key>ProgramArguments</key> | |
| <array> | |
| <!-- Be sure to set this path correctly! --> | |
| <string>/Users/yourusername/bin/start-gpg-agent.sh</string> | |
| </array> | |
| <key>RunAtLoad</key> | |
| <true/> | |
| </dict> | |
| </plist> |
| # Ensure that gpg can find the agent when needed | |
| if [ -f ~/.gnupg/.gpg-agent-info ] && [ -n "$(pgrep gpg-agent)" ]; then | |
| source ~/.gnupg/.gpg-agent-info | |
| export GPG_AGENT_INFO | |
| else | |
| eval $(gpg-agent --daemon --write-env-file ~/.gnupg/.gpg-agent-info) | |
| fi | |
| # This line is important for GUI tools to also find it | |
| launchctl setenv GPG_AGENT_INFO $GPG_AGENT_INFO |