How do I Setup Signed Commits?

[wesdevpro]

👇

[wesdevpro]

Attention! All development team members are now required to use GPG to sign each commit to GitHub. This will allow extra security when reviewing code on GitHub and GitHub PRs. Each signed commit that has been pushed to GitHub will show a verified sticker.
To set up GPG you must first have git and GitHub Desktop installed.

1. Start by installing GPG from the link above
2. Generate a GPG key in your terminal (CMD on Windows)!

2.1 gpg --full-generate-key note you may have to change gpg with gpg2 depending on what system you have installed GPG
2.2 Select RSA and RSA as the key type
2.3 Key size should be set to 4096 bits.
2.4 When prompted to enter user ID information, enter the verified email address for your GitHub account. The note could be ntohq gpg key.
Note: This should be the email and username you selected to use in GitHub Desktop for commits (GitHub Desktop -> File -> Options -> git -> Email
2.5 Add a passphrase as required. (Must be at minimum 8 characters long, have special characters, upper and lower case characters)
2.6 Wait for GPG to finish generating the RSA key.

3. Verify GPG successfully generated the key gpg2 --list-secret-keys --keyid-format LONG your should see your key listed.

3.1 Copy the GPG key ID (i.e sec rsa4096/<key id>)

4. Copy the key and add it to your GitHub account

4.1 Get the RSA key by using the following command gpg2 --armor --export <key id> Note: the start and end headers must be included when you copy the key from the terminal
4.2 Navigate to https://github.com go to your settings on the left hand menu look for and select SSH and GPG keys
4.3 Click New GPG Key
4.5 Give the key the name of Education Trail Dev Team
4.6 Paste the RSA GPG key into the Key text box and press the Add GPG Key button

5. Set up GIT

5.1 IMPORTANT GIT MUST BE INSTALLED
5.2 Follow this tutorial to tell git to sign with your GPG key https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key
Note: you will need the GPG key id copied in step 3.1 still, also unless you know how to turn on and off signing commits just set signing to always on as specified in the tutorial