Appearance

Powered by Platform One

Commit Signing with GPG ​

IMPORTANT

If your projects are in IL4 and IL5, you must sign commits with your CAC instead.

Store your GPG private key in a secure place. It should be treated like a password.

Party Bus Does not support using IDE's for code signing. You are free to do so, but If you cannot sign commits in your IDE, please do not open a ticket with the PartyBus help desk. You will need to fix your issue or use the command line to sign commits that you create in your IDE.

Summary ​

Developers who don't have a Common Access Card (CAC) can sign their commits using a Gnu Privacy Guard (GPG) key. To learn how to sign commits using a CAC, follow this guide: HowTo - GitLab - Commit Signing with CAC.

Step-by-Step Guide ​

MAC ​

Install GPG (with Homebrew).

bash
brew `install` gpg

WARNING

In step 2, when generating the GPG key, be sure to use gpg --full-gen-key In step 3, when selecting the algorithm, choose RSA and RSA

Windows ​

  1. Install GPG for windows here: Gpg4win - Get Gpg4win. a. It will ask you to donate, just click 0 and then download it.
  2. Open up windows environment variable settings. a. Under "user variables," click "new" and add the path to the gpg.exe file. screenshot1 b. Under "system variables," find the path entry and double click it. c. Click on "new" and paste the path previously used.
  3. Open up a command terminal. a. Type gpg --list-keys to check if you have any gpg keys already created. screenshot2 b. If you already have a key created, assign it to git using git config --global user.signingkey 1234567890 (i.e., instead of these numbers, use the serial number of your signing key).
  4. Create a GPG key. a. With GnuPG already installed, in your command terminal, type gpg --full-gen-key. b. Enter the information the same way it is in the console screenshots below (i.e., change your name and email address to match your information). screenshot3screenshot4 c. Once you enter "O" to save it, it will ask you to enter a passphrase. Enter the passphrase of your choice so that it can generate a random key. d. Once the key is generated, follow step 3 to assign the key to git.

    NOTE

    The user.email Git variable must be set. To set it, execute: git config --global user.email < GitLab email >

After a GPG key has been generated, added to a user's GitLab account, and assocated with Git, the below commands may be used to sign commits.

bash
# Manually sign specific commits:
git commit -S -m "My commit message"
# Or configure Git to sign all commits:
git config --global commit.gpgsign true

VSCode Integration (for Mac) ​

  1. Inside VSCode, open Settings (cmd+ or Preferences->Settings). a. Find Git: Enable Commit Signing and enable it. (i.e., quickly find the setting by searching for gpg.)

  2. VSCode must also be configured to prompt the user for a key password. Follow the commands below.

    bash
    brew install pinentry-mac:
echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf
killall gpg-agent

  3. The user will be prompted to enter the key password on their next commit inside of VSCode.

Common Errors ​

General Troubleshooting ​

While debugging, commits may be traced using GIT_TRACE=1.

INFO

EXAMPLE:GIT_TRACE=1 git commit -S -m "test commit"

Commit "Unverified" in GitLab ​

Make sure the user.email Git variable has been set. To set it, execute: git config --global user.email < GitLab email >.

Error: GPG failed to sign the data fatal: failed to write commit object ​

Refer to this this Stack Overflow entry for additional error details and suggested solutions.

To resolve, complete the following:

  1. Execute echo "test" | gpg --clear sign. If the result is this: screenshot5

    • Execute export GPG_TTY=$(tty).
    • Execute echo "test" | gpg --clear sign again. The result should be something like this: screenshot6
    • If the result is this:
    bash
    gpg: signing failed: Timeout
gpg: [stdin]: clear-sign failed: Timeout

    restart the gpg-agent and then retry the command again.

    bash
    gpgconf --kill gpg-agent

Could not find identity matching specified user-id ​

If you recieve a message on commit similar to this error:

could not find identity matching specified user-id: XXXXXXXXXX
error: gpg failed to sign the data
fatal: failed to write commit object

It could be caused by a conflicting gpg.format settings in the git config.

  1. First, check to see if gpg.format is set: git config --get gpg.format.
  2. If it is set, try to unset it: git config --unset gpg.format and double check to ensure it was actually unset.
  3. If the cli --unset command didn't unset it, open up your ~/.gitconfig and manually delete the gpg.format and/or the format line under [gpg] . Run git config --get gpg.format to ensure it was actually removed.
  4. Try the commit again.

Powered By Platform One