Programming

In my work organization, we don't allow pushes from users that have not signed their commits. We also frequently make use of git blame along with git verify-commit. For this reason, we have most new developers at any level create a GPG key and add it to their GitHub profile shortly after they join or organization. We're a medium-sized FinTech organization though, so it's very important we keep track of who is touching what.

That said, I can't see it being all that important to an individual unless they're very security-focused. For me personally, I have multiple yubikeys and one is meant specifically for SSH authentication and GPG operations including signing commits. Since I use NixOS and home-manager, I use the programs.git module to setup automatic signing and key selection. I really haven't touched it at all in years now. It was very "set it and forget it" for me.

Why not use SSH keys? Imo they are much easier to manage.

Every time I have to reinstall my operating system (its really only a few times in a decade),

Reinstalling your operating system once a decade seems a bit excessive. When you're more experienced you'll probably not want to do it that often.

creating gpg keys

While it is a good practice to create new PGP keys with some regularity, there's absolutely no reason to do it at the same time as reinstalling your operating system, doing that is only an unnecessary complication. The normal thing to do is to copy the entire home directory (and at least the keyring) from the old installation to the new.

Am I doing enterprise level security for the sake of an icon or is this really more secure?

The purpose of PGP signing git commits is to make it possible for others to verify that a commit has been created by you and not by someone else pretending to be you

If there are other people who look at your commits and want to verify that they really were made by you then this matters a lot. If no-one does that with your commits, it doesn't matter at all.

yk you can backup your passphrase-protected gpg keys in one simple copy/paste command?

GPG keys

There’s your problem right there. Like, really. Use SSH keys for this, it is infinitely easier to deal with.

The badge lets others know you're a masochistic

How often are you reinstalling your OS? Maybe that's where your frustration should go.

Regarding access tokens, there's a third party credential helper for Linux that uses OAuth. I recently found it and started using it a month ago. Works pretty much the same as Git + Windows Credential Manager. In case you are running headless, there is a device mode flag that will allow you to login with the GitHub app on your phone.

https://github.com/hickford/git-credential-oauth

(And if you layer a timed cache helper before the OAuth helper... well you shouldn't have to reauthenticate every time!)

Otherwise, the Git manual lists some other credential helpers that interface with some password managers.

https://git-scm.com/doc/credential-helpers

This is my moment to shine. I hire developers specifically for their Cybersecurity qualifications, and I always look at their GitHub profiles.

So... There's like a security badge you can get? Neat.

But no, I guess I don't care about that.

Huh? Gh auth login

It's one of several reasons I moved to another platform. The amount of faff wasn't worth it for the few projects I fiddle with.