Skip to main content

Commit Signing

To protect against commit spoofing, all Bitwarden contributors must digitally sign their commits. This is optional but encouraged for community contributors.

Setting up commit signing​

Github supports commit signing with GPG, SSH and S/MIME. If you're unsure what to use, we recommend GPG.

  1. Install GnuPG:

    brew install gnupg
    echo "export GPG_TTY=$(tty)" >> ~/.zshrc

    Restart your open terminal for this to take effect

  2. Follow the Github documentation to configure commit signing

  3. Configure your preferred git tool below

  4. Push a test commit to Github and ensure that the "Verified" badge appears next to the commit description:

    Image showing the Verified badge in Github

Command Line​

  • After configuring commit signing, you can sign a commit by using the -S flag:

    git commit -S

  • To avoid using the -S flag every time, you can sign all commits by default:

    git config --global commit.gpgSign true

    (Remove the --global flag to only apply this setting to the current repository)

Visual Studio Code​

Enable commit signing in Preferences -> Settings -> search "commit signing".

macOS: GPG Key Passphrase Prompt Issue​

Some macOS users have had issues with VS Code and the gpg-agent not prompting for the GPG Key Passphrase in order to sign commits when using the VS Code git GUI. This is illustrated by VS Code displaying an error popup message: Git: gpg failed to sign the data.

A workaround for this issue is to configure your gpg-agent to use pinentry for macOS in order to force a secure prompt. Run the following in a terminal of your choice:

  1. brew install pinentry-mac
  2. echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf
  3. killall gpg-agent

Note: Note: you might have to restart VS Code for this to take effect, but you should now be prompted for your GPG Key Passphrase as needed. If this does not solve your issue, please follow the Troubleshooting guide below.

SourceTree​

Refer to Setup GPG to sign commits within SourceTree.

Troubleshooting​

  • If you receive the error message "error: gpg failed to sign the data", make sure you added export GPG_TTY=$(tty) to your ~/.zshrc (or ~/.bashrc if you're using bash) and restarted your terminal. Refer to this troubleshooting document for more help with this error