Does Sourcetree support git commit --gpg-sign?

For one of the projects I'm working on, it's contractually important that our source code has strong audit capabilities--we need to be able to determine who made (or at least authorized) each change. For git, this means using the --gpg-sign option for commit (usernames are not sufficient, since it's trivial to spoof someone's username).

Is it possible to do this using Sourcetree? Is anyone else trying to do this as well?

1 answer

1 accepted

Hi Neil,

This'll be in the next major Mac version if you're on the Mac. If you're using Windows then it won't be around for a while yet.

Cheers

Kieran,

I'm not sure this is actually working in 1.7.0. I have a gpg key so I entered by path to gpg (in this case /opt/local/bin/gpg since I installed via macports). When I try and enable the "sign all commits" it says there are no keys.

I even tried installing the GPGSuite from https://gpgtools.org/ with no dice. ST just doesn't see I have keys.

Hi Steve,

If you're using GPGTools then try the following path: /usr/local/MacGPG2/bin

That's what I use for mine and it works fine. There's probably a couple of reasons in your case. Firstly you need to specify the folder path, not to the file itself (I think if you copy/paste paths it overrides the restrictions to specify folder paths only) and it wants to know about gpg2 rather than gpg which is in the path.

Try that path and see how it goes.

Cheers!

I see it's still not available on Windows - 3 years later... Frustrating.

Found a work around:

git config --global gpg.program "c:/Program Files (x86)/GNU/GnuPG/gpg2.exe"

Now it works!

I have done this but its only able to sign when commit in terminal, sourcetree for windows sucks at this point really.

It works for me using the GUI or command line.  A dialog pops up prompting for the GPG password.

Be sure to also have

commit.gpgsign=true

set in your .gitconfig.

 

Hi Brett, thanks for your kind reply.

First I am into this crypto stuff after sign for keybase.io, so I am trying my best to encrypt whenever possible, with keys for different accounts etc.For now, I am trying to sign commits on GitHub and BitBucket.

Well I've done some testing here, when configuring gpgsign=true I can sign github commits if commits using the CL like here:https://github.com/mmatoscom/namshi/commit/6b05e0583be191a04f3a8147344cefcb40f2e5e6

commit.PNG

When I commit to Github using sourcetree, the result is "remote: Invalid username or password", At first, a keys misconfiguration was possible as I am dealing with them, but I assured the original working on was selected when goes to tools-options.

As you said, as sourcetree signing its not available for windows clients yet, would be great to overcome this with gpg2.exe soft.

My short solution for long term: I got docker for windows installed, so launched 2 linux containers under docker, with names github and bitbucket, and their /root/ (the home) linked as a volume to the each repositories roots in my laptop (container github to github root folder, and same for bbucket)

I am now trying to link the gpg over volumes, symlinks etc, as linking the volume in picture below to ~/.gnupg/. 

image2016-10-1 20:41:19.png

So all containers running under my system (keybase, github, bitbucket) would be sharing the same gnupg directory using docker volumes. The /home/keybase/mount is mounted in keybase windows install dir in my laptop (C:\Users\xxxxx\AppData\Roaming\Keybase). In near future I only have to link another container with same volume mounts to centralize management.

Than will config --global user and email different in each container, and also sourcetree in windows laptop.

Will keep posted here if succesfull or not.

Thanks again!

Marco

 

 

 

 

 

 

Suggest an answer

Log in or Join to answer
Community showcase
Brian Ganninger
Published Jan 23, 2018 in Sourcetree

Tip from the team: workflow and keyboard shortcuts

Supported Platforms macOS Sourcetree has a lot to offer and, like many developer tools, finding and using it all can be a challenge, especially for a new user. Everyone might not love ...

256 views 0 3
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you
Atlassian Team Tour

Join us on the Team Tour

We're bringing product updates and pro tips on teamwork to ten cities around the world.

Save your spot