Gpgwin key how to#

Git simply attaches a name and an email address to each commit. How can I be sure that only people who are authorized to do so make changes to the repository? How can I be sure that the commits are attributed to the person who actually authored the code? How can I be sure that nobody uploaded a malicious package of my software on my server by guessing my username and password? Signing your commits as part of an open source library or application) there's always a fear lurking. However, if you are part of a team of more than two people with a small handful of commits every day or if you are publishing your code (e.g.

At its simplest, you can use GitHub through its Windows application and you can log into your servers using a username and password.

Why do you need to bother with all of that I use it, for example, to access my home server from wherever I may be over SSH. Moreover, authenticating to SSH using a GPG key is definitely something that works in a context outside of Git. Signing your commits and authenticating with a GPG key is something you can do with any kind of Git hosting, even something you host on your own server. While what I describe is geared towards GitHub, the most popular Git hosting platform, it is by no means GitHub specific.

Gpgwin key how to#

Hence this article where I explain how to combine a YubiKey, GPG4WIN, PuTTY and Git for Windows on Windows 10 to access your GitHub account – and any SSH server – securely and sign your commits. I had to redo everything last week and I realised I couldn't remember a few non-obvious but critical steps. While I had set this up on Linux and macOS since 2017 I only had the time and patience to do that on my tertiary machine, a Windows 10 one, in late 2019. Moreover, this allows me to sign GPG commits and tags.

Having this stored in secure YubiKey hardware and locked behind a PIN is a step up in security authenticating to the remote resource requires physical possession of an unphishable hardware token and knowledge of a PIN. Over the last few years I have standardized my access to remote servers, including GitHub, using a GPG signing subkey as the authentication credential.