brew install gnupg21, pinentry-mac(this includes gpg-agent and pinentry)- Generate a key:
$ gpg --gen-key - Take the defaults. Whatevs
- Tell gpg-agent to use pinentry-mac:
$ vim ~/.gnupg/gpg-agent.conf
paste in
# Connects gpg-agent to the OSX keychain via the brew-installed$
# pinentry program from GPGtools. This is the OSX 'magic sauce',$
# allowing the gpg key's passphrase to be stored in the login$
# keychain, enabling automatic key signing.$
pinentry-program /usr/local/bin/pinentry-mac
- Tell git about it: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
$ gpg2 --list-keys
/Users/schacon/.gnupg/pubring.gpg
---------------------------------
pub 2048R/0A46826A 2014-06-04
uid Scott Chacon (Git signing key) <schacon@gmail.com>
sub 2048R/874529A9 2014-06-04
$ git config --global user.signingkey 0A46826A
- Tell git that you are using gpg2 like a boss
$ git config --global gpg.program gpg2
- Tell github about it https://help.github.com/articles/adding-a-new-gpg-key-to-your-github-account/
- Restart maybe or kill any running gpg-agents. They will not work.
- Sign your commits
$ git commit -S -m 'yolo'
You may also read:
- store your passwords in your system keychain. pinentry-mac provides this for you. you're not edward snowded.
- https://gist.github.com/bmhatfield/cc21ec0a3a2df963bffa3c1f884b676b
- https://alexcabal.com/creating-the-perfect-gpg-keypair/ <-- good background, but outdated and overly paranoid.
- Pick a primary system, laptop or not. Use a password manager for the gory details and harddrive encryption to cover your butt if your system gets stolen. Macs are a great option for this because they have FDE and 1Password. Generate master keypair taking the default setup on this primary system. Subkey out to other systems and devices. Back up your revocation cert. Remember to migrate your master key when you replace your primary system.