Notes: Using GPG to Sign Git Commits in VSCode

This is a documentation record for the steps to sign Git commits with GPG and the issues encountered.

To sign Git commits with GPG, you need to follow these steps:

Generate a GPG key pair
Add the GPG public key to your personal account settings
Associate it with your local Git repository
Sign Git commits
Verify the signature

Generate GPG Key Pair

Install GPG using the brew package manager. Linux seems to come with it pre-installed, and Windows users are on their own.

brew install gpg

Run the following command to generate a GPG key pair (public/private keys):

gpg --full-gen-key

This interactive command will guide you through the key generation process. The general flow is as follows:

Key type: Select the key type to use, or press Enter to choose the default.
Elliptic curve: Press Enter to select the default elliptic curve Curve 25519.
Expiration: Specify the key validity period as needed, or press Enter to choose the default of never expiring.
Email address: Must be an email address configured in your Github account.

List the created GPG keys:

gpg --list-secret-keys --keyid-format LONG "your_email"

You’ll see something like this:

sec   ed25519/4AEA00A342C24CA3 2021-09-14 [SC]
      6DE3507E82DEB6E8828FAAC34AEA00A342C24BD4
uid                 [ultimate] your_name "your_email"
ssb   cv25519/812B586FD245B560 2021-09-14 [E]

4AEA00A342C24CA3 is the id.

Export the public key for this ID:

gpg --armor --export 4AEA00A342C24CA3

Add it to your Github account settings.

Association

Run the following command to associate with your Git repository:

git config --global user.signingkey 4AEA00A342C24CA3

When committing from the command line, add the -S parameter to enable signing:

git commit -S -m "your commit message"

Or enable automatic signing:

git config --global commit.gpgsign true

VSCode GPG Signing

To enable GPG signing in VSCode, add the following configuration to your settings.json:

{
  "git.enableCommitSigning": true,
}

Linux is 100% compatible and doesn’t need any special handling.

Windows and macOS have issues where the gpg program may not be able to invoke the password input dialog in certain shells or outside of them.

Since I do less development on Windows, I haven’t solved this problem yet. I always commit through the shell.

Here’s how to handle it on macOS:

Allow gpg to use gpg-agent

echo 'use-agent' >> ~/.gnupg/gpg.conf

Install pinentry-mac, which is a GPG password input component for macOS.

brew install pinentry-mac

Configure pinentry-mac for gpg

echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf

Start gpg-agent

killall gpg-agent

After this, when committing in VSCode, the password input dialog will appear.