This tutorial is for Windows Only. The GNU/Linux version is here.
First, we need to make sure that we have git, gnupg and github-cli installed.
PS C:\> git --version
git version 2.42.0.windows.1
PS C:\> gpg --version
gpg (GnuPG) 2.4.3
libgcrypt 1.10.2
PS C:\> gh version
gh version 2.35.0 (2023-09-19)
https://github.com/cli/cli/releases/tag/v2.35.0
Note: we’ll use
gnupgto generate a GPG key pair. we’ll also usegithub-clito authenticate ourselves to GitHub (logging into our account with our cli).
If you don’t have these installed, you can use winget or other package managers for Windows to install these, or you can download installers from their websites.
winget install --id Git.Git -e --source winget
winget install -e --id GnuPG.GnuPG
winget install --id GitHub.cli
Note: The Windows installer modifies your PATH. You will need to open a new terminal after you’ve installed these tools, for the changes to take effect. (Simply opening a new tab will not be sufficient.)
gitIf you’re new to Git, you probably have to initialize it first. (It’s just a little “Name/Email” configuration, don’t worry.) Open a terminal (or Git bash) and do these:
git config --global user.name "YOUR NAME"
Tip: You can confirm that you have set the username correctly by using
$ git config --global user.name
git config --global user.email "YOUR@EMAIL.COM"
Tip: You can confirm that you have set the email correctly by using
$ git config --global user.email
To push a local repository to GitHub, we need access. The easiest way to gain access is to authenticate using github-cli.
GitHub CLI is an open-source tool for using GitHub from your computer’s command line. When you’re working from the command line, you can use the GitHub CLI to save time and avoid switching contexts.
gh auth login
GitHub.com and Follow the on-screen prompts.GitHub CLI automatically stores your Git credentials for you when you choose HTTPS as your preferred protocol for Git operations and answer “yes” to the prompt asking if you would like to authenticate to Git with your GitHub credentials. This can be useful as it allows you to use
git push,git pull, and so on, without needing to set up a separate credential manager or use SSH.
Now that you’ve initialized your Git, you need to generate your own GPG key pair and add it to your GitHub account. This is where gnupg will help us. Open a terminal (or Git bash) and do these:
gpg --full-generate-key
At the prompt, specify the kind of key you want, or press Enter to accept the default. (RSA and RSA is recommended.)
At the prompt, specify the key size you want, or press Enter to accept the default.
Enter the length of time the key should be valid. Press Enter to specify the default selection, indicating that the key doesn’t expire. Unless you require an expiration date. (Default is recommended.)
Verify that your selections are correct.
Enter your information.
Note: When asked to enter your email address, ensure that you enter the verified email address for your GitHub account.
Congratulations, we’ve generated your GPG key pair. Now, you need to copy your public key to add it to your GitHub account.
Use the gpg --list-secret-keys --keyid-format=long command to list the long form of the GPG keys for which you have both a public and private key.
From the list of GPG keys, copy the long form of the GPG key ID you’d like to use. In this example, the GPG key ID is 3AA5C34371567BD2:
PS C:\> gpg --list-secret-keys --keyid-format=long
/Users/hubot/.gnupg/secring.gpg
------------------------------------
sec 4096R/3AA5C34371567BD2 2037-03-10 [expires: 2037-05-10]
uid YOUR NAME <YOUR@EMAIL.COM>
ssb 4096R/4BB6D45482678BE3 2037-03-10
gpg --armor --export 3AA5C34371567BD2
Prints the GPG key ID, in ASCII armor format.
-----BEGIN PGP PUBLIC KEY BLOCK----- and ending with -----END PGP PUBLIC KEY BLOCK-----.Now that you have copied your public key, head over to Step 3 to add your public key to your GitHub account.
To sign commits associated with your account on GitHub, you can add a public GPG key to your account.
You can add multiple public keys to your account on GitHub. Commits signed by any of the corresponding private keys will show as verified. If you remove a public key, any commits signed by the corresponding private key will no longer show as verified.
To verify as many of your commits as possible, you can add expired and revoked keys. If the key meets all other verification requirements, commits that were previously signed by any of the corresponding private keys will show as verified and indicate that their signing key is expired or revoked.
To add your public key to your GitHub account, open a terminal (or Git bash) and do these:
In the upper-right corner of any page, click your profile photo, then click Settings.
In the “Access” section of the sidebar, click SSH and GPG keys.
Next to the “GPG keys” header, click New GPG key.
In the “Title” field, type a name for your GPG key.
In the “Key” field, paste the GPG key you copied when you generated your GPG key in Step 2.1.
Click Add GPG key.
To confirm the action, authenticate to your GitHub account.
And you’re done adding your public key to your GitHub account. Now you have to tell git about your GPG key.
git about your GPG key.If you’re using a GPG key that matches your committer identity and your verified email address associated with your account on GitHub.com, then you can begin signing commits and signing tags.
Open a terminal (or Git bash) and follow along:
Use the gpg --list-secret-keys --keyid-format=long command to list the long form of the GPG keys for which you have both a public and private key. Private key is required for signing commits.
From the list of GPG keys, copy the long form of the GPG key ID you’d like to use. In this example, the GPG key ID is 3AA5C34371567BD2:
PS C:\> gpg --list-secret-keys --keyid-format=long
/Users/hubot/.gnupg/secring.gpg
------------------------------------
sec 4096R/3AA5C34371567BD2 2037-03-10 [expires: 2037-05-10]
uid YOUR NAME <YOUR@EMAIL.COM>
ssb 4096R/4BB6D45482678BE3 2037-03-10
git config --global user.signingkey 3AA5C34371567BD2
git config --global commit.gpgsign true
Pro Tip: If you encounter an error after committing a change, you may need to tell git where your system’s gpg is located. You can easily fix this problem by entering the command:
git config --global gpg.program "C:\Program Files (x86)\path/to/your/gpg.exe"
Now you’ve completed setting up your GPG key pair to sign your Git commits on GitHub.
Try and make some commits, push them to GitHub and Check them out. There must be a little “Verified” tag on the commits you’ve made. 😃