Signing and Verifying Git Commits on the Command Line and GitHub

Описание: Manually and auto-sign / verify git commits and tags. Had an error? Check the pinned comment.

Hit the subscribe button to receive more videos like this!

---

As of mid-2021 the default gpg key server went offline so the search / receive commands in this video will likely fail unless you change your keyserver. I've been using Ubuntu's server.

I've made this update on the blog post version of the video at https://nickjanetakis.com/blog/signin.... Search the page for "offline" and you'll find the update on how to customize your keyserver.

---

Timestamps:

0:00 -- What we're going to cover in this video
0:46 -- Creating a dummy git repo to work with
1:30 -- Creating a signed git commit and verifying it
2:09 -- Why it's worth it to sign your commits
3:07 -- Creating lightweight, annotated and signed git tags
5:15 -- Auto-signing your commits and tags with a few gitconfig options
7:05 -- Auto-signing tags requires git 2.23+ or newer
7:45 -- Demonstrating auto-signing for commits and tags
8:41 -- Adding your GPG public key to your GitHub account to get verified
10:44 -- Verifying git commits from others on the command line
11:40 -- Searching a GPG Keyserver for a specific user's key
12:50 -- Importing another user's public GPG key straight from a Keyserver
14:24 -- Deleting another user's public GPG key from your keyring
15:10 -- Sending your public GPG key to a Keyserver
16:21 -- Importing another user's GPG public key without a Keyserver
17:31 -- Only merging in branches that have commits with verified signatures
19:26 -- Recap and a quick tooltip for verifying signatures on GitHub directly

Cheatsheet:

http://nickjanetakis.com/blog/signing...

Reference links:

   • Creating and Managing a GPG Key Pair   (Creating a GPG key pair)
https://github.com/nickjj/dotfiles

---

Follow along?

Personal Website: https://nickjanetakis.com
Twitter:   / nickjanetakis