git config --global user.name "Your Name"
git config --global user.email you@example.com

The author data is especially important when something goes wrong. Imagine a certain commit caused a security issue, or broke software in a way that should have been caught by tests. Who made this change? It is clear that we shouldn't trust the author listed by git log in this case.

Tags have partially solved this issue by allowing you to PGP sign them. As the git commit hash includes the parent hash, this signature validates the complete history up to that specific tag. The PGP signature is made by your personal key and is harder to fake.

Tags with a signature

Creating a signed tag is easy once you have set up your private key in GnuPG. Execute the tag command with the -s flag to sign the tag as you create it.

git tag -s <name>

Git should be able to automatically find your PGP key based on the e-mail address you've listed in the user.email setting. In case you don't want git to figure this out, it is also possible to set a default signing key globally:

git config --global user.signingkey 1234ABCD

That's it! Now your tag is signed. This moves the problem but doesn't actually solve it. Signed tags allow you to declare that you have checked the commit log and verified that it wasn't tampered with. It is now possible to verify the tag using git tag -v. This works fine for small projects and teams with only a few developers. But what if you're managing something bigger?

Your initial problem remains: How do you know for sure who changed your code? The real solution is obvious...

Signing every commit

Git v1.7.9 introduced the ability to cryptographically sign commits, similar to how it works with tags. The difference here is that the shortcode is uppercase -S as the lowercase flag is used for the Signed-off-by field already. Other than that, usage is pretty much the same.

git commit -am "Fixed something somewhere" -S 1234ABCD

There is quite a bit discussion about whether it is useful to sign every commit. Linus Torvalds explained why he thinks signing commits is a bad idea on a mailing list several years ago. The most important part is quoted below, but you should really read the whole message to get the full picture:

Signing each commit is totally stupid. It just means that you automate it, and you make the signature worth less. It also doesn't add any real value, since the way the git DAG-chain of SHA1's work, you only ever need one signature to make all the commits reachable from that one be effectively covered by that one. So signing each commit is simply missing the point.

Git doesn't provide a way to automatically sign every commit, although you could use a bash alias or something similar to make signing semi-automatic.

Update: Since Git 2.0 it is possible to configure Git to sign all your commits using the commit.gpgsign option.

Signing public keys

The GPG software allows you to sign other public keys, similar to how you can sign messages or basically any kind of data. Signing a public key however, has a special meaning. You declare that that, according to you, the key you've signed is real and really represents the listed person or organisation.

There are four signature levels:

• Level 0 signature: no indication. This is the default level and is usually used by people who don't know or don't care about signature levels. A lot of people don't specify the signature level when they sign public keys, so there is no reason to discard these right away.
• Level 1 signature: personal belief but no verification. As the name says this level is used when someone signs a key but was unable to verify the identity. Used for nicknames, most of the time, as you can't really prove the identity behind a pseudonym. Be careful when you encounter a level 1 signature on a key with a full name and e-mail address. These levels have to be specified manually, if someone changes it to level 1, it might be for a reason.
• Level 2 signature: casual verification: These signatures usually mean that people have met and checked identification, but didn't know each other upfront.
• Level 3 signature: extensive verification: The level used when the signer was absolutely sure that the listed name is correct. Usually this means that they have known each other in person for years and have checked government issues identification.

Note that this is the theory. The signature level names (indicated above) are listed in the GPG documentation. The explanation of these levels is unclear and usually very personal. People use them in different ways, and some even have a webpage explaining what their levels mean. And then there's the huge group that only uses level 0 signatures. So in the end, they're just a vague indication.

If you are able to verify the owner of a public key, sign their public key. Most graphical frontends for PGP have an easy way to do this, the command below signs a key using the command line:

$ gpg --sign-key <name>

But why are these signatures important?

Introducing the Web of Trust

You can't know everyone, that's just impossible. I am aware that some people claim to have thousands of friends on social networks, but seriously? However, the people that you know may overlap with the ones I know. What is the easiest solution when you need someone's phone number but have no means to communicate? Ask a mutual friend! And that's how the Web of Trust works.

Let's say that you have a personal friend Alice and want to send an encrypted message to Bob. You met Bob on an online message board and don't know him in person. You could ask Bob to verify the fingerprint of his public key, but someone might be tampering with the connection. It's possible to verify the identity of an internet stranger without meeting him, but it's pretty hard.

Fortunately Alice knows Bob in person, and we are able to verify Alice's key as we can meet her. We could use encrypted and signed communication to ask Alice if the key we have for Bob is correct. But if Alice has signed Bob's key, we don't even have to talk to her! As we trust Alice and her signatures, we are assured that Bob's key is correct.

You --> Alice --> Bob

The more keys you sign and the more people sign yours, the easier it becomes to identify the correct public keys for other people. So when you meet someone that uses PGP, attempt to sign each other's keys. And never sign a key if you are not sure about the person's identity. The strength of the web of trust is your responsibility.

Trust levels

Similar to signature levels, PGP also has a concept called trust levels. You can assign trust to keys in your keyring. This level indicates how much you trust a person's ability to sign other keys.

There are 5 levels:

• Unknown: The default level for keys.
• None: These signatures are ignored completely when calculating the web of trust. Use this when you think someone is not able to make trustworthy signatures.
• Marginal: You have marginal trust in the owner of this key, but don't believe them if they're the only one signing a key. Their signatures are accepted if multiple marginally trusted keys sign the same public key. This level will probably be used the most in your keyring.
• Full: You trust the owner of this key completely. When this person signs a public key, the software trusts that signature as if you have signed it yourself.
• Ultimate: Use this level for your own keys.

To modify the trust level of a key using the command line, edit keys in interactive mode and use the trust command:

$ gpg –edit-key <name>
trust

Combine these levels with the Web of Trust, and you have a way to select the correct public key for people around the world.

Keysigning parties

As you know by now, the strength of the web of trust depends on the number of signatures. Arranging to meet with people one by one takes a lot of time and may be costly, as transportation is not free. That's why people organise keysigning parties. Don't get your hopes up, they're not as fun as they sound.

During these parties people verify each other's keys. Some of these are pretty well organised and require you to register upfront, they then publish an easy to use list of participants and their fingerprints. Smaller parties may require you to bring printed fingerprints yourself. While it may get boring after a while, especially when there are a lot of participants, it's a great time to talk to security-minded people too!

Local signing

Just a note.. In case you really want to sign a key that you can't verify, use local signing. This works the same, but indicates that the signature shouldn't be shared with others. Local signatures never leave your own keyring and thus don't influence the Web of Trust.

$ gpg -lsign-key <name>