rickub
◆ docs

Verified commits (GPG)

Sign your commits with GPG so they carry a green Verified badge — create a key, register its public half on rickub, and point git at it.

What makes a commit Verified

Commit pages and commit lists check signatures when they render. A commit shows Verified only when all three of these hold:

  • the commit is signed with GPG — an OpenPGP signature carried in the commit's gpgsig header;
  • the signature validates against a key registered on your account (any key added under Settings → GPG keys; a signing subkey works too);
  • the commit's committer email (git config user.email) matches the email of your rickub account, case-insensitively.

The third rule is deliberate: a signature proves a key made it, not that the key's owner is the committer. A valid signature whose account email does not match the committer renders as Unverified — rickub won't vouch for an identity it can't bind.

Note

Verification happens at render time, so registering a key also verifies commits you signed before it — and deleting a key stops its commits from showing as verified.

1. Create a signing key (if you don't have one)

gpg --full-generate-key

Accept the default key type, enter your name, and give the key your rickub account email — that is the address rickub shows next to the key, and the one your commits' committer email must match.

Note

If the gpg command is missing: on macOS, brew install gnupg; on Debian/Ubuntu, sudo apt install gnupg.

2. Register the public half

Export the armored public key and paste the whole block — from -----BEGIN PGP PUBLIC KEY BLOCK----- to -----END PGP PUBLIC KEY BLOCK----- — into Settings → GPG keys, then press Continue:

gpg --list-secret-keys --keyid-format long   # find your key's fingerprint
gpg --armor --export FINGERPRINT

To prove you hold the private key, rickub then shows a one-time challenge together with the command that signs it. Copy the command from the page, run it in a terminal, and paste the entire -----BEGIN PGP SIGNED MESSAGE----- block it prints back into the form:

echo 'rickub-gpg-challenge|…' | gpg --clearsign

gpg signs with your default secret key and prints the clearsigned block on standard output — copy everything from -----BEGIN to END PGP SIGNATURE-----. The challenge expires after 15 minutes; if it has expired by the time you submit, paste your public key again to get a fresh one.

3. Point git at the key

git config --global user.signingkey FINGERPRINT
git config --global user.email "you@your-account-email"   # must match your rickub account email
git config --global commit.gpgsign true                   # sign every commit from now on

With commit.gpgsign on, a plain git commit is signed; use git commit -S to sign a single commit without turning it on globally. Tags work the same way with git tag -s.

If commits still show Unverified

  • “gpg: signing failed: Inappropriate ioctl for device” — common in tmux, CI, and some IDE terminals. Point gpg at a terminal before committing: export GPG_TTY=$(tty).
  • The signature doesn't verify — check that you registered the key git actually signs with (git config user.signingkey), and inspect what git sees with git log --show-signature. If git signs with a subkey, export the primary fingerprint: gpg --armor --export includes the subkeys.
  • The signature verifies but the badge stays Unverified — the committer email doesn't match your account email. When they differ, fix your git config user.email or your account email in Settings.
  • Nothing is signed at all — commit.gpgsign is off or set only in another repository. git config --get commit.gpgsign inside the repo tells you what applies.
Next steps