Commit Signatures with GPG

commit-siggy.sh

#!/usr/bin/env bash

## make sure /usr/local/sbin exists - it *should* be created by homebrew on install
if [ ! -d /usr/local/sbin ]; then
  echo "Homebrew didn't create /usr/local/sbin - creating now..."
  sudo mkdir /usr/local/sbin
  sudo chown $(whoami):admin /usr/local/sbin
  chmod 775 /usr/local/sbin
fi

## install gpg2
echo "Installing pinentry-mac and gpg2 from Homebrew..."
brew update
brew install pinentry-mac
brew install gpg2

## make sure there aren't any unknown keys - use `gpg --delete-secret-keys [keyid]` to remove keys
gpg --list-secret-keys --keyid-format LONG

echo ""
echo "If there are any keys you don't know about, exit now and delete them with"
echo "gpg --delete-secret-keys [keyid]"
echo ""
read -rp "Press Enter to continue... "

## generate an RSA4096 key
echo "Beginning GPG key generation. Choose:"
echo ""
echo " - RSA & RSA (default)"
echo " - 4096 bits (not default)"
echo " - Reasonable expiration"
echo " - Enter your identity information, including the verified email address on GitHub"
echo " - A password"
echo ""
gpg --full-generate-key

gpg --list-secret-keys --keyid-format LONG
## get the secret key id - the "sec"/"[SC]" key id (after rsa4096/)
KEYID=$(gpg --list-secret-keys --keyid-format LONG | grep "rsa4096" | grep "sec" | awk '{print $2}' | cut -d'/' -f2)

## get the public key to paste into GitHub
gpg --armor --export "${KEYID}" | pbcopy

echo ""
echo "Open GitHub, go to Settings > GPG Keys, add a new key, and paste the public key from your clipboard..."
echo ""
read -rp "Press Enter to continue..."

## set up git for automatic commit signatures
echo ""
echo "Setting up git for automatic commit signatures..."
git config --global gpg.program /usr/local/bin/gpg
git config --global commit.gpgsign true
git config --global user.signingkey "${KEYID}"