To configure Git to automatically sign your commits for GitHub, you can follow these steps:

  1. Generate a GPG key (if you don’t have one already):

    1

    $ gpg --full-generate-key

    Follow the prompts to create your key. Make sure to use the same email address associated with your GitHub account.

  2. List your GPG keys to find the key ID:

    1

    $ gpg --list-secret-keys --keyid-format LONG

  3. Copy the GPG keyID (the part after sec and before the /).

  4. Configure Git to use your GPG key:

    1

    $ git config --global user.signingkey YOUR_KEY_ID

  5. Enable commit signing by default:

    1

    $ git config --global commit.gpgSign true

  6. Export your GPG public key to add it to GitHub:

    1

    $ gpg --armor --export YOUR_KEY_ID

    Copy the output of this command.

  7. Add the GPG key to your GitHub account:

    • Go to GitHub and navigate to Settings > SSH and GPG keys > New GPG key.
    • Paste the copied GPG public key into the field and save it.

  8. Install Pinentry: Install a pinentry program suitable for your operating system to handle passphrase prompts.

  9. Test your setup by making a signed commit:

    1

    $ git commit -S -m "Your commit message"

  10. Push your commit to GitHub:

    1

    git push origin your-branch

    Your commits should now be automatically signed and verified on GitHub!

What is pinentry?

Pinentry is a collection of passphrase entry dialogs which is used by GnuPG to securely prompt users for their passphrases. It provides a way for GPG to request the passphrase needed to unlock private keys without exposing it to the terminal or other applications.

How to install pinentry-mac?

If you’re using Homebrew on macOS, you can install pinentry-mac with the following command:

1

$ brew install pinentry-mac

To check pinentry

1

$ echo GETPIN | pinentry-mac

Common Error

If you encounter the error gpg: signing failed: Inappropriate ioctl for device, it usually means that GPG is trying to prompt for a passphrase in a non-interactive environment. To fix this, you can configure GPG to use a different pinentry program that works in your terminal.

For example, you can set it to use pinentry-curses:

1

$ echo "pinentry-program /opt/homebrew/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf

Restart the GPG agent to apply the changes:

1
2
3
4

$ gpgconf --kill gpg-agent

# restart gpg-agent
$ gpgconf -R

Verify the pinentry configuration:

1

$ gpgconf -X

Still Seeing Errors?

Make sure you are using /opt/homebrew/bin/pinentry-mac instead of /opt/homebrew/bin/pinentry-mac in your GPG configuration.

to check location use this command

1

$ which pinentry-mac

How to check GPG config?

Use gpgconf to see the current configuration of your GPG agent.

1
2
3
4
5
6
7
8
9
10

$ gpgconf -X
...
* Config files

** local config "/Users/user-name/.gnupg/gpg-agent.conf"
#+begin_src
  pinentry-program /opt/homebrew/bin/pinentry-mac

#+end_src
...