Sign Git commits with SSH keys

From Aram's Wiki
Jump to: navigation, search

Introduction

Git can use ssh-keygen(1) to sign commits and tags. The problem is that if you want to avoid entering passphrases it requires a running ssh-agent(1). This is the case even if you configured ssh to automatically decrypt keys using iCloud Keychain, as ssh-keygen(1) will not read ~/.ssh/config.

How to

We're going to make git(1) run a helper script that temporarily loads the required key into the ssh agent, setting a short timeout.

Create helper script

Create this file and put it in your PATH, I'm using ~/bin/git-config-helper-gpg.ssh.defaultKeyCommand. 

#/bin/bash

ssh-add -q -t 5 --apple-load-keychain ~/.ssh/id_ed25519
KEY=$(ssh-add -L | head -n 1)
echo key::$KEY

Configure Git to use SSH for signing

git config --global gpg.format ssh
git config --global gpg.ssh.defaultKeyCommand ~/bin/git-config-helper-gpg.ssh.defaultKeyCommand

This configures git(1) to use SSH signing (as opposed to GPG) and instructs it to run our helper when it needs to sign.

Configure Git to verify signatures

Record a list of known email-signature pairs in .ssh/allowed_signers (file name and location is arbitrary): 

aram@mgk.ro ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRc0UWKrFpCv/EOUo2jpEQt+C/pa0tc1rUWKgjbKTp7 aram@edengate.local

Then configure git(1) to use this file for verification: 

git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers

Sign every commit

Optionally, you might want to automatically sign every commit and tag: 

git config --global commit.gpgsign true
git config --global tag.gpgsign true

How to use

Sign your commits using git commit -S (or enable autosigning). To check signatures use git log --show-signature.

GitHub

GitHub needs to be aware of signing keys. A SSH key has to be specifically marked as a signing key in order for GitHub to show "verified" status.

References

Retrieved from "https://xw.is/w/index.php?title=Sign_Git_commits_with_SSH_keys&oldid=705"