Keybase proof gist software#
Keybase proof gist free#
Keybase proof gist windows#

(captured above as ), yielding the PGP signature: -BEGIN PGP MESSAGE. Then go to Settings > SSH and GPG keys in GitHub. A dialog will appear which includes a text box containing your public key. ) and click on the public key in the identity list. The easiest way I found to get the public key is to go to your Keybase profile (i.e. Gpg: marginals needed: 3 completes needed: 1 trust model: pgp Once saved, your key should now be listed with ultimate trust: Please note that the shown key validity is not necessarily correct (by looking at passports, checking fingerprints from different sources, etc.)ĭo you really want to set this key to ultimate trust? (y/N) y Please decide how far you trust this user to correctly verify other users keys Once that’s done, you can push your updated key back into Keybase. There is NO WARRANTY, to the extent permitted by law.Įmail address: *********.comĬhange (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O

Keybase proof gist free#

This is free software: you are free to change and redistribute it.

Keybase proof gist software#

Keybase proof gist windows#

I used Git Bash on Windows 10, because I find it easier than CMD or PowerShell, but can use your preferred terminal.įirst, export your public and private keys from Keybase using the keybase pgp command: Updating the GPG keyīefore you begin, I’m assuming you have Keybase installed and working via command line, and you have a GPG key already in your Keybase account. It turns out that Git needed it in there anyway, so it all works out nicely. Ultimately, I needed to export my key from Keybase into GPG so I could modify it directly. This seems like an oversight to me, but my understanding of this is limited, so there may be a good reason. I tried looking through the Keybase options, but couldn’t find any default way to modify the key and add email addresses. As a result, we need to do a few more things to get everything working. It also won’t match the email address in your commits. This isn’t a live email address and therefore GitHub will be unable to verify it. GitHub provides a settings page for setting your GPG key, however if you upload your raw GPG key from Keybase, it will likely contain a Keybase user reference. This won’t stop someone trying to spoof your commits, but it will provide assurance of your real commits so they can be properly verified. This allows GitHub to mark your commits as Verified when it can match your verified email to your GPG key. However, Git does support cryptographically signing commits using a GPG key. Unfortunately, there isn’t a way to stop someone from spoofing a commit with your name and email.

However, from a security point of view, it’s a problem. This is due to the distributed nature of Git, which allows anyone to push anyone else’s commits around. So if you set the author on the commit to be a valid email address, it will look like they made the commit. Git will accept any name and email address as the commit author and so will GitHub. It may sound difficult, but it’s actually a very trivial process. Why should we sign Git commits?Ī few days ago, I was at NDC Security and saw a talk by Phil Haack where he spoofed a “malicious” commit to look like it was made by Troy Hunt (who was also speaking). I went from not having a GPG key installed locally through to seeing my commits marked as Verified on GitHub.

This tutorial walks you though the process I took to set up Git commit signing with my Keybase GPG key. Then, once you’ve your commits are signed, GitHub provides a nice interface for verifying commits have been signed and by whom. If you’re a Keybase user, it’s pretty easy to use your Keybase GPG key for signing your Git commits. It uses the author’s GPG key to leave a signature in the commit that can be checked later. It is an optional feature that provides a way for the author of a commit to prove ownership. A relatively unknown and underused feature of Git is the ability to cryptographically sign commits.