
Have you noticed on GitHub that some git commits have a green box that says "Verified," while other commits do not? Have you ever read a `contributing.md` file that talks about signing commits? Or maybe you know someone that made a pull request that did not pass a continuous integration pipeline because a commit was not signed?

In this article, I discuss why it is good practice to sign git commits. Then I describe how to sign git commits by setting up a GNU Privacy Guard (GPG) key, and linking it to GitHub. Finally, I give an example of how to sign a commit.

## Why Sign Git Commits?

In an age where computer software powers so much of our world, we might not always think about _who_ wrote a particular piece of software. However, when we first create a git repository, we have the option to configure our own name and email. Imagine for a moment what might happen if a malicious software engineer created an application, but claimed to be someone else? With git, this could be as easy as

```
git config user.name "Tim Cook"
git config user.email "tim@apple.com"
```

After pushing some code to GitHub on an open source project, the username and email would show that Tim Cook wrote this code. Although a repository maintainer would likely be dubious that Tim Cook from Apple wrote the code for their project, this example illustrates how easy it is to falsely impersonate a different identity. Fortunately however, the above example would not show up as a "signed" or "verified" commit on GitHub (unless a user with access to *tim@apple.com* created their own GPG key, linked it to GitHub, and signed the commits).

In another more realistic example illustrating the utility of signing git commits, [CNN Reported in 2013](https://www.cnn.com/2013/01/17/business/us-outsource-job-china/index.html) that a software developer outsourced his own job, and hired other software developers for years to write his own code while he watched cat videos online. If the companies that employed this individual required that everyone sign their commits, then this would have been a lot more difficult to outsource and take credit for someone else's work.

Now eight years later, in a world where many companies and open source projects require developers to sign their commits, you might ask, how do I do that? This rest of this article will describe signing git commits with a GNU Privacy Guard (GPG) key.

## Setting up a GPG Key on Your Local Machine

To sign your git commits, you first need to create a GPG key on your local machine that associates your GitHub username and email with _you_. In the command line, first check if you have gpg installed with

```
gpg --help
```

You should see this command print options to the terminal. If you do not, you need to either download `gpg` from [the GNU website](https://gnupg.org/download/), or install it with `apt-get install gnupg`. Next, you should check that you have the right permissions on your local machine to create _your own_ GPG key with

```
gpg --list-keys
```

If output from this command says anything about a permissions error, then see the permissions section below, otherwise, skip to the generating a key value pair section.

### Dealing with a Permissions Error

The permissions error is sometimes caused when the super user has ownership of the folder containing GPG keys, but you as the current user do not. To fix this, you can create a new directory and have the GPG program look for your keys there instead.

First, create a new directory to store your own GPG keys with something like

```
mkdir my-gpg-keys
```

Then, open your `.profile`, `.bashrc`, or `bash_profile` file and add a line that that gives the path to the directory you just created like this

```
GNUPGHOME=/home/YOURNAME/my-gpg-keys
```

Save, and close the file, and re-source the current terminal with something like

```
source .bashrc
```

### Generating a GPG Key Value Pair

To generate a GPG key value pair, you should check what version of `gpg` you are using with

```
gpg -v
```

If you are on `gpg` 2.1.17 or greater, you should run

```
gpg --full-generate-key
```

If you are on a version less than 2.1.17 (but still greater than 2), then you can run

```
gpg --default-new-key-algo rsa4096 --gen-key
```

For people on really old versions (like `gpg` version 1.4.20), you can run `gpg --gen-key`.

In all cases, if prompted, we want to select the _default_ options, _4096_ keysize, and something like _1y_ (or whenever you want your GPG to expire) for expiration. I recommend not having your GPG key expire more than a year into the future.

Next, you will be asked to enter your username, and email. It is important to have these **exactly** match the name and email you use for GitHub. After you enter this, you need to enter a password that you will remember (or that you can add to your password manager).

After you have entered this information, the `gpg` program will generate a key value pair. Depending on how old your computer is, this might only take a few seconds, or it could take several minutes. It might also ask you to do things like move the mouse or work on something else, as this helps the `gpg` program generate enough random information to build the GPG key.

## Linking Your GPG Key with GitHub

Now it's time to link your GPG key to GitHub. As [described on GitHub](https://docs.github.com/en/github/authenticating-to-github/managing-commit-signature-verification/generating-a-new-gpg-key), you should first type this into the terminal:

```
gpg --list-secret-keys --keyid-format=long
```

The key you just generated will show up with the "4096" keysize and the expiration date you chose as something like

```
sec   4096R/3BB5634371567BD9 2021-09-01 [expires: 2022-09-01]
```

In this fictitious example, you should copy the `3BB5634371567BD9` part, and use it in this command:

```
gpg --armor --export 3BB5634371567BD9
```

This will print out a very long GPG key. You need to copy all of it, including the

`-----BEGIN PGP PUBLIC KEY BLOCK-----`

through the

`-----END PGP PUBLIC KEY BLOCK-----`

parts.

On your GitHub account page, select the options on the top right-hand side, select _Settings_, then _SSH and GPG keys_, and click "New GPG key".

You can then paste in the long key you just copied, and click "Add GPG key".

## Signing a Commit

Now that you've generated your own GPG key, and linked it to GitHub, signing a git commit is easy. For example, suppose you just make some changes to some code. You can add them all with

```
git add -A
```

Then you can commit them with a message and sign them at the same time with something like this

```
git commit -S -m 'this fixes blah blah...'
```

The capital _S_ above means _sign_.

After you hit enter, you will have to input the password you used when setting up your GPG key. Once you've done with that, you can push your code to GitHub.

You can also check locally that the commit was signed with

```
git log --show-signature
```

If you've made it this far, congratulations! You now know how to sign git commits.


How to Sign Your Git Commits with a GPG Key


As a former Windows user several years ago, I remember envying people that were able to automate tedious tasks using Linux. Luckily I discovered Ubuntu, a Linux variety that offers people with backgrounds in Windows and Mac a seamless transition to the world of Linux. I started my Linux journey in 2014, but recently had to re-learn the process of installing Linux on a new laptop. In this article, I briefly go over the steps for installing Ubuntu 20.04, also known as _Focal Fossa_, on a computer.

For this article, you will first need a new or old laptop with at least 5 GB of storage, a 4GB or larger USB stick, and another computer that has access to the internet to download the Ubuntu 20.04 image file. The key steps to installing Ubuntu 20.04 are to (1) download the image or `.iso` file, (2) write the image to the USB drive, and (3) install Ubuntu 20 on the desired computer from the USB drive.

## Obtaining an Image File

Before you can install Ubuntu 20, you need to prepare a USB drive with an `image` or `.iso` file. To do this, head on over to [Canonical's website](https://ubuntu.com/#download), and under "Ubuntu Desktop" select "20.04 LTS." This will download the image file you need to put on the flash drive. Depending on your internet speed, this might take an hour or more to download. The good news however, is that this is by far the longest step in the process.

## Writing the Image to a USB

Once you have downloaded the image file, you need to use special software to prepare the the USB stick. This step depends on what operating system you used to download the image file. Here I give a very brief overview for Windows, Mac, and Linux.

### Windows Users

Windows users can download [Rufus](https://rufus.ie/en/). After downloading, you just need to configure the "Boot selection" as the image file that you just downloaded, and the Device, which is Ubuntu 20 in this case.

### MacOS Users

Mac users can download [Balena Etcher](https://www.balena.io/etcher/). Select "Etcher for MacOS" for download. If you intend to install Ubuntu 20 on an old Mac or on new Mac hardware, please follow [Canonical's instructions](https://ubuntu.com/tutorials/create-a-usb-stick-on-macos#3-prepare-the-usb-stick) on first preparing the USB stick before writing the image with Etcher.

### Linux Users

If you are already on a Linux system, then plug in the blank USB drive. Then, click on the Linux applications icon and type in "Startup Disk Creator". When I clicked on Startup Disk Creator, it automatically recognized both the image I downloaded in the `Downloads` folder, and also the target USB drive. After clicking "Make Startup Disk", it took a few minutes to prepare the USB drive. Make sure to right click and eject the USB drive before pulling it out of the computer socket, or the image may not be properly written to the stick.

## Installing Ubuntu 20 on a Computer from USB

Now that you have a USB drive with an Ubuntu 20 image written to it, it's time to install Ubuntu 20 on the new or old computer. For this step, although not necessary, I recommend plugging in an Ethernet cable to your computer for faster internet (or make sure you know the WiFi password) so that you can optionally download what you want for your Ubuntu 20.04 operating system, and so that the installer can do things like help you automatically pick a time zone.

First, insert the USB drive into the target computer. Then, turn on the computer, and immediately press the key to enter the Boot Menu. For me, this was `F7`, but for your computer this might be `F2`, `F10`, `F12`, or `ESC`. Once inside the Boot Menu, you can use the arrow keys to select "Ubuntu" from the list of options. After you've done that, the Ubuntu installation menu gives you the option to either try out or install Ubuntu 20.04. Then the installer lets you choose your language, time zone, login name, and password.

That's pretty much it. For a more in depth version of installing Ubuntu, I recommend [Canonical](https://ubuntu.com/blog/author/canonical) as a valuable resource.


How to Install Ubuntu 20.04 Locally


Although the Linux command line can seem intimidating at times, it holds the power to greatly improve our productivity as web developers. In this article, I cover one of my all-time favorite Linux commands - the `grep` utility.

## Using `grep` to Search for Strings

The `grep` command lets users find strings in files. Computer scientist Ken Thompson (who also helped create the Golang programming language), originally authored the `grep` utility in 1973, and `grep` continues to be an integral part of Unix operating systems today. Its basic usage is like this

```bash
grep someWord someFile.txt
```

The above command searches inside someFile.txt for all occurrences of the word "someWord". The `grep` command will then print each line where a match for "someWord" was found to the terminal. In this example, `grep` is case sensitive. Therefore, "sOmEword" and "someword" will not be matches. To get a case-insensitive match, we can add in the `-i` flag like this

```bash
grep -i someWord someFile.txt
```

and this can sometimes come in handy.

## Why I Love `grep`

So why is `grep` useful to us as developers you might ask? The `grep` command can be helpful for both working in our own projects, and in someone else's codebase.

For example, in web development, I frequently write out JavaScript `console.log` statements to check the expected behavior of variables. Although I usually remove these when I'm done testing something, before deploying an application, I like to double check that I have not left any `console.log` statements in any of my files. To do this, I use the following `grep` command from the main directory of the project I'm working on:

```bash
grep -rl 'console.log' --exclude-dir=node_modules ./*
```

This `grep` command _recursively_ (via the _r_ flag) searches all files below the current working directory for "console.log", and prints to the terminal a _list_ (using the _l_ flag) of all files that contain a match. Pretty cool, right? But what if in addition to `node_modules`, you also don't want to search in `.git` and `.cache`? You can just add those in brackets to form a _glob_ with the exclude flag like this

```bash
grep -rl 'console.log' --exclude-dir={node_modules,.git,.cache} ./*
```

Then `grep` will also not search in the `.git` and `.cache` folders.

While the above examples focus on how we might use `grep` in searching for a `console.log` statement, I've found `grep` to be incredibly useful when learning a new codebase to see where some function is being used, tracking down software bugs based on an error message, and finding files using a string that needs to be renamed during a code refactor. This last example in particular lays the framework on how `grep` can be combined with another powerful Linux command - the `sed` utility, which I intend to discuss in a future article.


Love of Linux

Featured Posts

How to Sign Your Git Commits with a GPG Key

How to Install Ubuntu 20.04 Locally

Leveraging the Linux grep Command for Web Development