Setup gpg signing

We should explore setting up commit signing with GPG in Desktop. This could take two forms (or both):

Automatic commit signing using GitHub's GPG key in the same way that dotcom does it today, if the user is signed in to GitHub from Desktop.
Allow people to set up and utilize their own GPG key to sign commits in Desktop, and make that visible to users during the commit flow.

@shawndavenport

There's a lot to flesh out here. @shawndavenport was going to look into drafting up what is typically required. For example, we might even consider having a commit signing "agent" be a separate (but bundled) Electron app that any Git tool could leverage. That sounds cool, but I have no idea if it's actually feasible. 😄

I know basically nothing about what's involved here. Does the agent need to provide UI?

I know basically nothing about what's involved here. Does the agent need to provide UI?

Maybe? I would assume if we want to use it across git clients (so the git command line could use it), that it would. I was thinking it might be somewhat like our Welcome Wizard but for commit signing and would help with key management.

This is still pie in the sky thinking though. My hope is if we can keep it somewhat decoupled from Desktop, your team could ignore it for now and maybe we can get the security team to help build it. 😄 🔒

xref https://github.com/github/windows-ecosystem/issues/43

Pass git the shell environment.

Any news on this? Essential functionality and has been open for over a year.

@foss-

Any news on this? Essential functionality and has been open for over a year.

Hi @foss-, this is something that we're interested in but it's not part of our immediate roadmap. The best way to stay up to date would be to subscribe to this issue. I've heard whispers about it being possible to set up even though we currently lack first class support for it in the app (@shiftkey?) so if someone has got it working please feel free to share your workarounds here.

Bringing this over from the duplicate:

It would be even better if the app integrated with Keybase so it could automatically obtain the GPG key.

@niik

We've fixed some reported issues about our commit step failing when a user has signing enabled and configured already (see #1391 and #1578 for example) and if you're seeing errors like those in the app we'd like to fix it, but @niik is right in that we don't have inbuilt support for configuring commit signing in the app.

#1974 indicates that we don't prompt for the user to enter the passphrase associated with the GPG key, we may need to support this flow for users who don't want to use gpg-agent to provide this transparently.

@shiftkey

@shiftkey thanks for the info shared! Keep up the good work!

@xavierfoucrier

Just my two cents: If the development team wants a clear focus and roadmap, what's covered in this guide should be perfect: https://docs.github.com/en/authentication/managing-commit-signature-verification

It covers all necessary steps including the creation of the key and could probably be implemented relatively easily as it just calls git under the hood. Creating the key would require gpg but that can be declared as a dependency in brew etc. or added to the install instructions for the standalone installer.

And on a sidenote: @xavierfoucrier's guide (Thanks for creating this!) is basically a condensed version of this and works perfectly so the steps from there could also be implemented but some more manual intervention is required that would have to be done by the application.

I guess this issue has become more of a feature request for setting up and managing gpg in the GUI?

@niik

@niik @joshaber @steveward @sergiou87
(Sorry guys, I don't know how to tag "Desktop maintainers")

Proposal

I created a working example of interacting with GPG for Windows:
https://github.com/samuelko123/gpg-for-win

Features

Zero package dependencies
Embedded gpg.exe and gpg-agent.exe - No need to ask users to install anything
Embedded pinentry-basic.exe - It will pop up to ask for passphrase when required
Allow custom homedir - By default, gpg keys are stored in %APPDATA%\gnupg. We can create a custom folder to store keys.

UI Design [Rough]

Create primary key button
Create signing key button
Copy public key button (The link is https://github.com/settings/gpg/new)
Enable signing checkbox - It will run a few git config --local commands.
Show expiry date for signing keys (No image)

Next Step

If you don't mind, I'm happy to attempt a PR (which will be more detailed and with a feature flag).
Let me know if you have any questions.

Proposal 2

gpg.exe is based on OpenPGP Specification.

There are many open-source projects that implement the spec, for example:
https://github.com/openpgpjs/openpgpjs
https://github.com/ProtonMail/gopenpgp

According to git source code, the signing behaviour of gpg.exe is basically taking the signing key from git, read the message from stdin, then output the signed message.

It means we can build an .exe from the packages above, then use the .exe in git config --local gpg.program.

Pros:

Cross-platform
Full control over passphrase prompting/caching behaviour (no pin-entry or gpg-agent)
Flexibility for key management integrations

Cons:

Requires a default key management implementation, which can be tricky (plus documentations)
Packaging a Node.js file into .exe can be large (a Hello World is 30MB - using pkg)
Building .exe from Golang is much smaller, but yet another language to maintain

Let me know if you have any questions.

@samuelko123

@samuelko123 thanks so much for the work you've done investigating GPG support! This is something we've looked into previously, and the implementation would require a fair bit of input and work from the team. At this time this isn't something that we have the capacity to take on due to being a small team and having other competing priorities. I'm sorry that I don't have better news and want you to know that we really do appreciate the thought and effort you've put into this. Hopefully this is something we can revisit again in the future when we have more bandwidth.

@steveward

@steveward Thanks for your reply.
One of the benefits of being open-source is that people can contribute to what matters to them.
I understand that you have limited capacity and priorities. Therefore I'm simply asking for permission to design + implement + raise a PR.

Regardless, it's a valuable learning experience for me to deep dive into gpg and cryptography.

@SnowballXueQiu

Another suggestion by @SnowballXueQiu in #17401

The feature request

I think you can automatically set up the GPG Key for GitHub Desktop, so that when pushing commits, it can get a Verified Commits.

Proposed solution

You can add a New blank in GitHub called GitHub Desktop Security. In that page, users can connect their trust GitHub Desktop to GitHub. Then GitHub automatically sets up the GPG Key. It is no use to show to users or others. It just for the inner communication between GitHub and GitHub Desktop. After setting up, when users push therir commits, they will gain a Verified tag.

Apart from these, this is not meaning this is not security. All the actions are taken by GitHub, as long as GitHub makes sure this is absulutely security, it just security.

Addition: this GPG Key can not be used in other place.

Thank You!

Additional context

Hey still no news about being able to autosign with gpg key ? Actually I get this error. It work well on git, maybe not to difficulte to just add the support on desktop. But with a configuration done on git ?

@xavierfoucrier

RE: #78 (comment)

The problem I ran into is entering the passphrase. If I create a commit via the command line, then create a commit with GitHub Desktop, it works great! That's because gpg-agent caches the passphrase for a period of time.

I'm not sure how we'd hook into that and show the passphrase prompt on behalf of the user.

I'm not sure where I first learned about this, but on macOS you can configure gpg-agent via ~/.gnupg/gpg-agent.conf to use pinentry-mac

https://formulae.brew.sh/formula/pinentry-mac
- Pinentry for GPG on Mac
- https://github.com/GPGTools/pinentry

From my dotfiles:

https://github.com/0xdevalias/dotfiles/blob/devalias/gpg/gnupg.symlink/gpg-agent.conf

# Connects gpg-agent to the OSX keychain via the brew-installed
# pinentry program from GPGtools. This is the OSX 'magic sauce',
# allowing the gpg key's passphrase to be stored in the login
# keychain, enabling automatic key signing.
pinentry-program /usr/local/bin/pinentry-mac

RE: #78 (comment)

Unfortunately to be able to get github desktop to work with GPG signing you have to disable passphrases.

This definitely isn't true as of 2023 on macOS with the pinentry-mac setup described above (and based on my dotfiles history, has probably worked since at least 2019)

RE: #78 (comment)

A good overview of (probably) steps to implement:

So as far as GPG signatures go, and making that process easy and a part of Desktop:

Check if GPG is installed, if not add GPG (or ask the user to install it)

Check if GPG key exists, otherwise ask them if they want to generate one.

Grabbing the GPG key and uploading it to their account, or asking them to (with link to GPG upload page or instruction page).

Visual feedback for Verified commits.

Message at the top, or exclamation icon in a bottom corner which will warn them about a lack of a GPG key.

Verify GPG key and tell Git about their key.

Originally posted by @trulysinclair in #78 (comment)

RE: #78 (comment)

Gist with an overview for manually setting this up:

I just created a Gist for this solution:
https://gist.github.com/xavierfoucrier/c156027fcc6ae23bcee1204199f177da

Originally posted by @xavierfoucrier in #78 (comment)

RE: #78 (comment)

We encourage anyone who wants this feature (or any issue) to emoji react on the issue. While we don't prioritize based on reactions, we do use them as an input into our prioritization process and it can be a useful signal for what things are most important to our users who watch the repo.

Any chance of getting the help-wanted label added so the community can work on this?

RE: #78 (comment)

Useful:

Just my two cents: If the development team wants a clear focus and roadmap, what's covered in this guide should be perfect: https://docs.github.com/en/authentication/managing-commit-signature-verification

It covers all necessary steps including the creation of the key and could probably be implemented relatively easily as it just calls git under the hood. Creating the key would require gpg but that can be declared as a dependency in brew etc. or added to the install instructions for the standalone installer.

And on a sidenote: @xavierfoucrier's guide (Thanks for creating this!) is basically a condensed version of this and works perfectly so the steps from there could also be implemented but some more manual intervention is required that would have to be done by the application.

Originally posted by @BastianZim in #78 (comment)

RE: #78 (comment)

Useful:

I created a working example of interacting with GPG for Windows:
https://github.com/samuelko123/gpg-for-win

Features

Zero package dependencies

Embedded gpg.exe and gpg-agent.exe - No need to ask users to install anything

Embedded pinentry-basic.exe - It will pop up to ask for passphrase when required

Allow custom homedir - By default, gpg keys are stored in %APPDATA%\gnupg. We can create a custom folder to store keys.

..snip..

Next Step

If you don't mind, I'm happy to attempt a PR (which will be more detailed and with a feature flag).
Let me know if you have any questions.

Originally posted by @samuelko123 in #78 (comment)

RE: #78 (comment)

One of the benefits of being open-source is that people can contribute to what matters to them.
I understand that you have limited capacity and priorities. Therefore I'm simply asking for permission to design + implement + raise a PR.

Adding the help-wanted label would be good here IMO.

Navigation Menu

Repository navigation

Setup gpg signing #78

49 remaining items

Proposal

Features

UI Design [Rough]

Next Step

Proposal 2

The feature request

Proposed solution

Additional context

Features

Next Step

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Setup gpg signing #78

Description

Activity

haacked commented on Jun 27, 2016

joshaber commented on Jun 28, 2016

haacked commented on Jun 28, 2016

shiftkey commented on Jun 28, 2016

foss- commented on Jul 5, 2017

niik commented on Jul 5, 2017

j-f1 commented on Jul 21, 2017

shiftkey commented on Jul 24, 2017

shiftkey commented on Jul 28, 2017

jccguimaraes commented on Jul 28, 2017

49 remaining items

BastianZim commented on Dec 2, 2021

meadowsys commented on Dec 2, 2021

samuelko123 commented on May 21, 2023

Proposal

Features

UI Design [Rough]

Next Step

samuelko123 commented on May 22, 2023

Proposal 2

steveward commented on May 23, 2023

samuelko123 commented on May 23, 2023

sergiou87 commented on Sep 20, 2023

The feature request

Proposed solution

Additional context

bastin-thomas commented on Nov 8, 2023

0xdevalias commented on Dec 17, 2023

Features

Next Step

JakobJingleheimer commented on Feb 14, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions