Skip to content
This repository has been archived by the owner on Jul 20, 2019. It is now read-only.
/ probot-gpg Public archive

A GitHub App that enforces GPG signatures on pull requests (no longer maintained)

License

Notifications You must be signed in to change notification settings

jarrodldavis/probot-gpg

Repository files navigation

Probot GPG logo

Probot GPG

Probot Head logo

A GitHub App built with Probot that enforces GPG signatures on pull requests

Deprecation

This GitHub App is no longer being kept up-to-date and is considered deprecated. It is recommended to use GitHub's built-in enforcement of commit signature verification instead.

Setup

# Install dependencies
npm install

# Run the bot
npm start

Usage

Configure this app on your organizations and repositories. Be sure to enable required status checks if you want to enforce GPG signatures on all pull requests.

See docs/deploy.md if you would like to run your own instance of this plugin.

How it works

Git supports signing commits with GPG keys to verify commit authorship beyond the easy-to-forge author field.

GitHub supports verifying GPG signatures on commits and has an excellent series of help articles for creating a GPG key, using it with git locally, and linking it to a GitHub account.

After installation, this app checks all commits of new (or newly updated) pull requests for valid GPG signatures according to the GitHub API. Note that for the status check to be success, every contributor of a pull request must:

  • set up a GPG key on their local machine
  • sign all of their commits in the pull request with that key
  • link that key with their GitHub account

GPG status check success screenshot

Otherwise, the app will set the status to failure.

GPG status check failed screenshot

Email privacy

If you or any of your contributors use a GitHub-provided noreply email address to keep a personal email address private, that noreply address should be used when creating a GPG key. Make sure that git's config is also using that noreply address so that GitHub associates the GPG key correctly and validates it.

Further reading

Special thanks and attributions