The Code Wanderer - terminalWandering through OpenBSD, privacy, security, programming, and data science. Powered by open source.Zola2026-06-09T00:00:00+00:00https://hervyqa.srht.site/categories/terminal/atom.xmlConfiguring GPG & OpenSSH for Git on OpenBSD2024-06-19T00:00:00+00:002026-06-09T00:00:00+00:00
Hervy Qurrotul
https://hervyqa.srht.site/blog/configuring-gpg-openssh-for-git/<p>
<a href="https://gnupg.org">GnuPG</a> (The GNU Privacy Guard) is one of the standards that
implements OpenPGP as defined by
<a href="https://www.ietf.org/rfc/rfc4880.txt">rfc4880</a>. The purpose of
GnuPG is to encrypt and sign data and communications, as well as manage
system keys.
<a href="https://gnupg.org">GnuPG</a> is also known as GPG, which refers to
<code>gpg</code> as a CLI tool that facilitates integration with other applications
and supports <em>Secure Socket Shell (SSH)</em>.</p>
<p>Since 1997, GnuPG has been one of the free software programs that
cares about user data privacy. GnuPG can be used freely, modified, and
distributed under the GPL license.</p>
<h2 id="benefits-of-using-gnupg-keys">Benefits of using GnuPG keys<a class="post-anchor" href="#benefits-of-using-gnupg-keys" aria-label="Anchor link for: benefits-of-using-gnupg-keys"><span aria-hidden="true">#</span></a>
</h2>
<p>By using GnuPG keys, users will get the following three benefits.</p>
<ul>
<li><strong>Data integrity</strong>: GnuPG keys ensure the integrity of digital content
by creating digital signatures. This allows users to verify that the
content has not been tampered with during transit or delivery.</li>
<li><strong>Authentication</strong>: GnuPG keys provide a mechanism for authenticating
the source of digital content. Users can verify that the content
originates from a trusted and verified entity.</li>
<li><strong>Secure communication</strong>: GnuPG keys facilitate secure communication
by enabling encryption. This ensures that only authorized parties can
access encrypted data.</li>
</ul>
<p>In addition, GnuPG is very useful when working with Git. To implement
it, users will enter a password into the pinentry or cli dialog for the
purpose of providing authentic authentication. Then the username will
appear in each commit with this command, which will show the digital
signature validation in each marker with <code>--gpg-sign</code>.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> commit</span><span style="color: #569CD6;"> --gpg-sign -m</span><span style="color: #CE9178;"> "sign with gpg key"</span></span>
<span class="giallo-l"><span style="color: #6A9955;"># or</span></span>
<span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> commit</span><span style="color: #569CD6;"> -S -m</span><span style="color: #CE9178;"> "sign with gpg key"</span></span></code></pre>
<p>Once successful, users can view the digital signature on each commit
with the <code>--show-signature</code> parameter.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> show 1af04a6001</span><span style="color: #569CD6;"> --show-signature</span></span>
<span class="giallo-l"><span style="color: #6A9955;"> # ^ hash code</span></span></code></pre>
<p>It will look like this.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>commit 1af04a60013c8df1b0107ef29755b70feca402da (HEAD -> main, sh/main)</span></span>
<span class="giallo-l"><span>gpg: Signature made Fri 14 Jun 2024 07:44:44 PM WIB</span></span>
<span class="giallo-l"><span>gpg: using EDDSA key 5A131FCDDAC2876802F631D1D7B52C04D9B41849</span></span>
<span class="giallo-l"><span>gpg: Good signature from "Hervy Work Email (Test) <work@mail.org>" [ultimate]</span></span>
<span class="giallo-l"><span>Primary key fingerprint: 5A13 1FCD DAC2 8768 02F6 31D1 D7B5 2C04 D9B4 1849</span></span>
<span class="giallo-l"><span>Author: Hervy Work Email <work@mail.org></span></span>
<span class="giallo-l"><span>Date: Fri Jun 14 19:44:44 2024 +0700</span></span></code></pre>
<p>Written <code>Good signature from</code> the original marker in the log header.
Using GnuPG, Git, and OpenSSH is highly recommended because they can
provide a written validation trail.</p>
<p>This article explains:</p>
<ul>
<li><a href="https://hervyqa.srht.site/blog/configuring-gpg-openssh-for-git/./#gnupg-key-configuration">GnuPG Key Configuration</a>.</li>
<li><a href="https://hervyqa.srht.site/blog/configuring-gpg-openssh-for-git/./#ssh-key-configuration">SSH Key Configuration</a>.</li>
<li><a href="https://hervyqa.srht.site/blog/configuring-gpg-openssh-for-git/./#git-configuration">Git Configuration</a>.</li>
</ul>
<p>This article was written using OpenBSD operating system, as the aim is
to narrow the scope of the discussion so that it does not spread to all
operating systems (the article could become pages long if written for
multiple OS). The second reason is that currently, no operating system
other than OpenBSD is installed.</p>
<p>However, please note that all the tools used in this article, including
GnuPG, OpenSSH, and Git, are <em>Open Source</em> and can therefore be used on
other operating systems such as Linux-based, Windows or MacOS. In this
explanation, you can skip to the steps you need.</p>
<h2 id="gnupg-key-configuration">GnuPG Key Configuration<a class="post-anchor" href="#gnupg-key-configuration" aria-label="Anchor link for: gnupg-key-configuration"><span aria-hidden="true">#</span></a>
</h2>
<h3 id="installing-gnupg">Installing GnuPG<a class="post-anchor" href="#installing-gnupg" aria-label="Anchor link for: installing-gnupg"><span aria-hidden="true">#</span></a>
</h3>
<p>GnuPG can be installed on various operating systems. Users can choose
the guide based on the operating system they are currently using.</p>
<h4 id="openbsd">OpenBSD<a class="post-anchor" href="#openbsd" aria-label="Anchor link for: openbsd"><span aria-hidden="true">#</span></a>
</h4>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">pkg_add</span><span style="color: #CE9178;"> gnupg</span></span></code></pre><h4 id="freebsd">FreeBSD<a class="post-anchor" href="#freebsd" aria-label="Anchor link for: freebsd"><span aria-hidden="true">#</span></a>
</h4>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">pkg</span><span style="color: #CE9178;"> install gnupg</span></span></code></pre><h3 id="checking-the-gnupg-version">Checking the GnuPG version<a class="post-anchor" href="#checking-the-gnupg-version" aria-label="Anchor link for: checking-the-gnupg-version"><span aria-hidden="true">#</span></a>
</h3>
<p>The first thing to do after installing GnuPG is to check its version
with <code>gpg</code>.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">gpg</span><span style="color: #569CD6;"> --version</span></span></code></pre><pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>gpg (GnuPG) 2.4.5</span></span>
<span class="giallo-l"><span>libgcrypt 1.10.3</span></span>
<span class="giallo-l"><span>Copyright (C) 2024 g10 Code GmbH</span></span>
<span class="giallo-l"><span>License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html></span></span>
<span class="giallo-l"><span>This is free software: you are free to change and redistribute it.</span></span>
<span class="giallo-l"><span>There is NO WARRANTY, to the extent permitted by law.</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Home: /home/hervyqa/.gnupg</span></span>
<span class="giallo-l"><span>Supported algorithms:</span></span>
<span class="giallo-l"><span>Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA</span></span>
<span class="giallo-l"><span>Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,</span></span>
<span class="giallo-l"><span> CAMELLIA128, CAMELLIA192, CAMELLIA256</span></span>
<span class="giallo-l"><span>Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224</span></span>
<span class="giallo-l"><span>Compression: Uncompressed, ZIP, ZLIB, BZIP2</span></span></code></pre>
<p>For example, the version above uses version <code>2.4.5</code>.</p>
<h3 id="creating-a-new-gnupg-key">Creating a new GnuPG key<a class="post-anchor" href="#creating-a-new-gnupg-key" aria-label="Anchor link for: creating-a-new-gnupg-key"><span aria-hidden="true">#</span></a>
</h3>
<p>If the version you are using is <code>2.1.17</code> or above, it is recommended to
use this terminal command.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">gpg</span><span style="color: #569CD6;"> --full-generate-key</span></span></code></pre>
<p>Meanwhile, if the version is below <code>2.1.17</code>, use <code>--gen-key</code>.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">gpg</span><span style="color: #569CD6;"> --default-new-key-algo</span><span style="color: #CE9178;"> rsa4096</span><span style="color: #569CD6;"> --gen-key</span></span></code></pre><h3 id="selecting-a-key-algorithm">Selecting a key algorithm<a class="post-anchor" href="#selecting-a-key-algorithm" aria-label="Anchor link for: selecting-a-key-algorithm"><span aria-hidden="true">#</span></a>
</h3>
<p>After running the command, a selection of key algorithm types to use
will appear.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>gpg (GnuPG) 2.4.5; Copyright (C) 2024 g10 Code GmbH</span></span>
<span class="giallo-l"><span>This is free software: you are free to change and redistribute it.</span></span>
<span class="giallo-l"><span>There is NO WARRANTY, to the extent permitted by law.</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>gpg: directory '/home/hervyqa/.gnupg' created</span></span>
<span class="giallo-l"><span>Please select what kind of key you want:</span></span>
<span class="giallo-l"><span> (1) RSA and RSA</span></span>
<span class="giallo-l"><span> (2) DSA and Elgamal</span></span>
<span class="giallo-l"><span> (3) DSA (sign only)</span></span>
<span class="giallo-l"><span> (4) RSA (sign only)</span></span>
<span class="giallo-l"><span> (9) ECC (sign and encrypt) *default*</span></span>
<span class="giallo-l"><span> (10) ECC (sign only)</span></span>
<span class="giallo-l"><span> (14) Existing key from card</span></span>
<span class="giallo-l"><span>Your selection?</span></span></code></pre>
<p>There are several options: 1, 2, 3, 4, 9, 10, 14. Just press {{< kbd
Enter >}} to select number 9 <code>ECC (sign and encrypt)</code> as the default.</p>
<p>Next, select the type of elliptic curve to use.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>Please select which elliptic curve you want:</span></span>
<span class="giallo-l"><span> (1) Curve 25519 *default*</span></span>
<span class="giallo-l"><span> (4) NIST P-384</span></span>
<span class="giallo-l"><span> (6) Brainpool P-256</span></span>
<span class="giallo-l"><span>Your selection?</span></span></code></pre>
<p>Press <kbd>enter</kbd> to select number 1 <code>Curve 25519</code> as the
default.</p>
<h3 id="selecting-the-gnupg-key-expiration-time-limit">Selecting the GnuPG key expiration time limit<a class="post-anchor" href="#selecting-the-gnupg-key-expiration-time-limit" aria-label="Anchor link for: selecting-the-gnupg-key-expiration-time-limit"><span aria-hidden="true">#</span></a>
</h3>
<p>Next, select the key expiration time. It is recommended to select 0 to
choose no expiration time.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>Please specify how long the key should be valid.</span></span>
<span class="giallo-l"><span> 0 = key does not expire</span></span>
<span class="giallo-l"><span> <n> = key expires in n days</span></span>
<span class="giallo-l"><span> <n>w = key expires in n weeks</span></span>
<span class="giallo-l"><span> <n>m = key expires in n months</span></span>
<span class="giallo-l"><span> <n>y = key expires in n years</span></span></code></pre>
<p>Select <kbd>0</kbd> to choose number 0 <code>key does not expire</code> and
select <kbd>y</kbd> to confirm.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>Key is valid for? (0)</span></span>
<span class="giallo-l"><span>Key does not expire at all</span></span>
<span class="giallo-l"><span>Is this correct? (y/N)</span></span></code></pre><h3 id="enter-gnupg-user-data">Enter GnuPG user data<a class="post-anchor" href="#enter-gnupg-user-data" aria-label="Anchor link for: enter-gnupg-user-data"><span aria-hidden="true">#</span></a>
</h3>
<p>Next, enter the user’s GnuPG data. Enter the name, email address, and
comments. For example:</p>
<ul>
<li>Real name: Hervy Work Email</li>
<li>Email address: <a href="mailto:work@mail.org">work@mail.org</a></li>
<li>Comments: Test</li>
</ul>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>Real name: Hervy Work Email</span></span>
<span class="giallo-l"><span>Email address: worka@mail.org</span></span>
<span class="giallo-l"><span>Comment: Test</span></span></code></pre>
<p>The result of the GnuPG key user data will look like this.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>You selected this USER-ID:</span></span>
<span class="giallo-l"><span> "Hervy Work Email (Test) <work@mail.org>"</span></span></code></pre>
<p>If you want to confirm, select <kbd>o</kbd> (okay).</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o</span></span></code></pre>
<p>Ensure that no errors appear in the terminal output. An example of
successful output is shown below.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>We need to generate a lot of random bytes. It is a good idea to perform</span></span>
<span class="giallo-l"><span>some other action (type on the keyboard, move the mouse, utilize the</span></span>
<span class="giallo-l"><span>disks) during the prime generation; this gives the random number</span></span>
<span class="giallo-l"><span>generator a better chance to gain enough entropy.</span></span>
<span class="giallo-l"><span>We need to generate a lot of random bytes. It is a good idea to perform</span></span>
<span class="giallo-l"><span>some other action (type on the keyboard, move the mouse, utilize the</span></span>
<span class="giallo-l"><span>disks) during the prime generation; this gives the random number</span></span>
<span class="giallo-l"><span>generator a better chance to gain enough entropy.</span></span>
<span class="giallo-l"><span>gpg: /home/hervyqa/.gnupg/trustdb.gpg: trustdb created</span></span>
<span class="giallo-l"><span>gpg: directory '/home/hervyqa/.gnupg/openpgp-revocs.d' created</span></span>
<span class="giallo-l"><span>gpg: revocation certificate stored as '/home/hervyqa/.gnupg/openpgp-revocs.d/5A131FCDDAC2876802F631D1D7B52C04D9B41849.rev'</span></span>
<span class="giallo-l"><span>public and secret key created and signed.</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>pub ed25519 2024-06-06 [SC]</span></span>
<span class="giallo-l"><span> 5A131FCDDAC2876802F631D1D7B52C04D9B41849</span></span>
<span class="giallo-l"><span>uid Hervy Work Email (Test) <work@mail.org></span></span>
<span class="giallo-l"><span>sub cv25519 2024-06-06 [E]</span></span></code></pre><h3 id="viewing-gnupg-key-id">Viewing GnuPG key ID<a class="post-anchor" href="#viewing-gnupg-key-id" aria-label="Anchor link for: viewing-gnupg-key-id"><span aria-hidden="true">#</span></a>
</h3>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">gpg</span><span style="color: #569CD6;"> --list-secret-keys --keyid-format</span><span style="color: #CE9178;"> long</span></span></code></pre><pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>/home/hervyqa/.gnupg/pubring.kbx</span></span>
<span class="giallo-l"><span>--------------------------------</span></span>
<span class="giallo-l"><span>sec ed25519/D7B52C04D9B41849 2024-06-06 [SC]</span></span>
<span class="giallo-l"><span> Key fingerprint = 5A13 1FCD DAC2 8768 02F6 31D1 D7B5 2C04 D9B4 1849</span></span>
<span class="giallo-l"><span>uid [ultimate] Hervy Work Email (Test) <work@mail.org></span></span>
<span class="giallo-l"><span>ssb cv25519/1CC5EEC8BDE8BC06 2024-06-06 [E]</span></span></code></pre>
<p>It should be noted that the user keys are:</p>
<ul>
<li>ID key = <strong>D7B52C04D9B41849</strong></li>
<li>Fingerprint key = <strong>5A13 1FCD DAC2 8768 02F6 31D1 D7B5 2C04 D9B4 1849</strong></li>
</ul>
<p>The GnuPG ID key can be integrated into the OpenSSH settings in the next step.</p>
<h2 id="ssh-key-configuration">SSH Key Configuration<a class="post-anchor" href="#ssh-key-configuration" aria-label="Anchor link for: ssh-key-configuration"><span aria-hidden="true">#</span></a>
</h2>
<p>
<a href="https://openssh.org">OpenSSH</a> (OpenBSD Secure Shell) is a tool for securing
network protocols based on <em>Secure Socket Shell</em>. OpenSSH is integrated
with several operating systems such as BSD, Windows, macOS, and most
Linux distributions.</p>
<p>SSH has several contexts, including:</p>
<ol>
<li>Refers to the <strong>Secure Socket Shell</strong> network protocol.</li>
<li>Refers to the <strong>OpenSSH</strong> software.</li>
<li>Refers to a commercial company called
<a href="https://www.ssh.com">SSH.com</a>.</li>
</ol>
<p>For clarification, this article uses two contexts, namely numbers 1
and 2. Number 3 is not possible because it is not the subject of this
article and is not a technical matter. To be clear, this article only
uses these two contexts.</p>
<ol>
<li>SSH as a network protocol, which refers to <strong>Secure Socket Shell</strong>.
Therefore, <strong>SSH keys</strong> refer to the authentication keys used for the
SSH network protocol.</li>
<li>The software that can manage, run, and generate SSH keys is
<strong>OpenSSH</strong> software.</li>
</ol>
<h3 id="installing-openssh">Installing OpenSSH<a class="post-anchor" href="#installing-openssh" aria-label="Anchor link for: installing-openssh"><span aria-hidden="true">#</span></a>
</h3>
<p>Similar to GnuPG, <strong>OpenSSH</strong> can be installed on any platform,
especially BSD or linux-based.</p>
<h4 id="openbsd-1">OpenBSD<a class="post-anchor" href="#openbsd-1" aria-label="Anchor link for: openbsd-1"><span aria-hidden="true">#</span></a>
</h4>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">pkg_add</span><span style="color: #CE9178;"> openssh</span></span></code></pre><h4 id="freebsd-1">FreeBSD<a class="post-anchor" href="#freebsd-1" aria-label="Anchor link for: freebsd-1"><span aria-hidden="true">#</span></a>
</h4>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">pkg</span><span style="color: #CE9178;"> install openssh</span></span></code></pre><h3 id="checking-the-openssh-version">Checking the OpenSSH version<a class="post-anchor" href="#checking-the-openssh-version" aria-label="Anchor link for: checking-the-openssh-version"><span aria-hidden="true">#</span></a>
</h3>
<p>Each operating system may have a different version of OpenSSH. Users can
view the Git version with this command.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">ssh</span><span style="color: #569CD6;"> -V</span></span></code></pre><pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>OpenSSH_9.7p1, OpenSSL 3.0.13 30 Jan 2024</span></span></code></pre>
<p>For example, the version above uses version <code>9.7p1</code>.</p>
<h3 id="checking-ssh-keys">Checking SSH Keys<a class="post-anchor" href="#checking-ssh-keys" aria-label="Anchor link for: checking-ssh-keys"><span aria-hidden="true">#</span></a>
</h3>
<p>SSH keys are used for remote control authentication. They are most
commonly used to log in to git forges such as sourcehut, github, or
gitlab.</p>
<p>Before configuring, make sure there are no SSH keys in the <code>~/.ssh</code>
directory. You can check this with the following terminal command.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">ls</span><span style="color: #569CD6;"> -al</span><span style="color: #CE9178;"> ~/.ssh</span></span></code></pre><pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>Permissions Size User Date Modified Name</span></span>
<span class="giallo-l"><span>.rw------- 203 hervyqa 21 Mar 07:09 config</span></span>
<span class="giallo-l"><span>.rw------- 464 hervyqa 21 Mar 07:09 id_ed25519</span></span>
<span class="giallo-l"><span>.rw------- 99 hervyqa 21 Mar 07:09 id_ed25519.pub</span></span>
<span class="giallo-l"><span>.rw------- 3.6k hervyqa 21 Mar 07:09 known_hosts</span></span></code></pre>
<p>Generally, there are three types of public key files:</p>
<ul>
<li>id_rsa.pub</li>
<li>id_ecdsa.pub</li>
<li>id_ed25519.pub</li>
</ul>
<p>If it is still empty, you can proceed to the next step to create a new
SSH key.</p>
<h3 id="creating-a-new-ssh-key">Creating a new SSH key<a class="post-anchor" href="#creating-a-new-ssh-key" aria-label="Anchor link for: creating-a-new-ssh-key"><span aria-hidden="true">#</span></a>
</h3>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">ssh-keygen</span><span style="color: #569CD6;"> -t</span><span style="color: #CE9178;"> ed25519</span><span style="color: #569CD6;"> -C</span><span style="color: #CE9178;"> "work@mail.com"</span></span></code></pre>
<p>If it doesn’t work, and you get an <code>invalid format</code> or <code>feature not supported</code> error, then there is hardware security that requires the use
of the <code>ecdsa-sk</code> algorithm.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">ssh-keygen</span><span style="color: #569CD6;"> -t</span><span style="color: #CE9178;"> ecdsa-sk</span><span style="color: #569CD6;"> -C</span><span style="color: #CE9178;"> "work@mail.com"</span></span></code></pre>
<p>Just press <kbd>enter</kbd> to select the default directory location.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>Generating public/private ed25519 key pair.</span></span>
<span class="giallo-l"><span>Enter file in which to save the key (/home/hervyqa/.ssh/id_ed25519): (ENTER)</span></span>
<span class="giallo-l"><span>Created directory '/home/hervyqa/.ssh'.</span></span></code></pre>
<p>Next, enter the user’s secret password.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>Enter passphrase (empty for no passphrase):</span></span>
<span class="giallo-l"><span>Enter same passphrase again:</span></span></code></pre>
<p>If successful, the output will look like this.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>Your identification has been saved in /home/hervyqa/.ssh/id_ed25519</span></span>
<span class="giallo-l"><span>Your public key has been saved in /home/hervyqa/.ssh/id_ed25519.pub</span></span>
<span class="giallo-l"><span>The key fingerprint is:</span></span>
<span class="giallo-l"><span>SHA256:KUfzOkl2FyOf5/30nIEH60jrdNV2HafUCl8fdjgVBL8 work@mail.com</span></span>
<span class="giallo-l"><span>The key's randomart image is:</span></span>
<span class="giallo-l"><span>+--[ED25519 256]--+</span></span>
<span class="giallo-l"><span>| .ooo|</span></span>
<span class="giallo-l"><span>| .+ |</span></span>
<span class="giallo-l"><span>| o . + +==|</span></span>
<span class="giallo-l"><span>| . + o B.=X|</span></span>
<span class="giallo-l"><span>| . S o +.=E*|</span></span>
<span class="giallo-l"><span>| = + . o=o.|</span></span>
<span class="giallo-l"><span>| + o +.oo|</span></span>
<span class="giallo-l"><span>| .o = .o=|</span></span>
<span class="giallo-l"><span>| .+ . .+|</span></span>
<span class="giallo-l"><span>+----[SHA256]-----+</span></span></code></pre>
<p>Please note, based on the output above, there are two files that you
need to know about:</p>
<ul>
<li>The private/secret key is located at: <code>~/.ssh/id_ed25519</code>.</li>
<li>The public key is located at: <code>~/.ssh/id_ed25519.pub</code>.</li>
</ul>
<p>The key that can be shared is <code>id_ed25519.pub</code> because it is public.</p>
<h3 id="changing-the-ssh-email">Changing the SSH Email<a class="post-anchor" href="#changing-the-ssh-email" aria-label="Anchor link for: changing-the-ssh-email"><span aria-hidden="true">#</span></a>
</h3>
<p>If you want to change the old SSH email name, you can use the following
command.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">ssh-keygen</span><span style="color: #569CD6;"> -c -f</span><span style="color: #CE9178;"> ~/.ssh/id_ed25519</span><span style="color: #569CD6;"> -C</span><span style="color: #CE9178;"> "newusername@mail.com"</span></span></code></pre>
<ul>
<li><code>-c</code> replaces the comment in the private and public keys.</li>
<li><code>-f</code> is the name of the private key file.</li>
<li><code>-C</code> is the comment name of the generated key.</li>
</ul>
<h3 id="adding-ssh-keys-to-ssh-agent">Adding SSH Keys to ssh-agent<a class="post-anchor" href="#adding-ssh-keys-to-ssh-agent" aria-label="Anchor link for: adding-ssh-keys-to-ssh-agent"><span aria-hidden="true">#</span></a>
</h3>
<p>By adding SSH keys to <code>ssh-agent</code>, if you are working with
<code>git</code>/<code>gitui</code>/<code>lazygit</code> in a terminal environment, you only need to
enter your password once. When <code>git push</code>/<code>git pull</code> with SSH, the
command will be executed directly without entering a password in the
future. Therefore, <code>ssh-agent</code> is very useful and convenient for users.</p>
<p>The following is the command to run ssh-agent in the background.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">eval</span><span style="color: #CE9178;"> "$(</span><span style="color: #DCDCAA;">ssh-agent</span><span style="color: #569CD6;"> -s</span><span style="color: #CE9178;">)"</span></span></code></pre>
<p>Then add the private key with ssh-add.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">ssh-add</span><span style="color: #CE9178;"> ~/.ssh/id_ed25519</span></span></code></pre><h2 id="git-configuration">Git Configuration<a class="post-anchor" href="#git-configuration" aria-label="Anchor link for: git-configuration"><span aria-hidden="true">#</span></a>
</h2>
<h3 id="installing-git">Installing Git<a class="post-anchor" href="#installing-git" aria-label="Anchor link for: installing-git"><span aria-hidden="true">#</span></a>
</h3>
<p>Git can also be installed on any platform, especially BSD.</p>
<h4 id="openbsd-2">OpenBSD<a class="post-anchor" href="#openbsd-2" aria-label="Anchor link for: openbsd-2"><span aria-hidden="true">#</span></a>
</h4>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">pkg_add</span><span style="color: #CE9178;"> git</span></span></code></pre><h4 id="freebsd-2">FreeBSD<a class="post-anchor" href="#freebsd-2" aria-label="Anchor link for: freebsd-2"><span aria-hidden="true">#</span></a>
</h4>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">pkg</span><span style="color: #CE9178;"> install git</span></span></code></pre><h3 id="checking-the-git-version">Checking the Git version<a class="post-anchor" href="#checking-the-git-version" aria-label="Anchor link for: checking-the-git-version"><span aria-hidden="true">#</span></a>
</h3>
<p>Each operating system may have a different Git version. Users can view
the Git version with this command.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #569CD6;"> --version</span></span></code></pre><pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>git version 2.44.1</span></span></code></pre>
<p>For example, the version above uses version <code>2.44.1</code>.</p>
<h3 id="adding-username-and-email">Adding Username and Email<a class="post-anchor" href="#adding-username-and-email" aria-label="Anchor link for: adding-username-and-email"><span aria-hidden="true">#</span></a>
</h3>
<p>Add an active username and email. The username uses a name from a git
forge account such as Sourehut, Github, Gitlab, Codeberg, or others. For
example, we will use <code>hervyqa</code> and <code>work@mail.com</code>.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> config</span><span style="color: #569CD6;"> --global</span><span style="color: #CE9178;"> user.name 'hervyqa'</span></span>
<span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> config</span><span style="color: #569CD6;"> --global</span><span style="color: #CE9178;"> user.email 'work@mail.org'</span></span></code></pre><h3 id="adding-gnupg-key-id-to-git">Adding GnuPG Key ID to Git<a class="post-anchor" href="#adding-gnupg-key-id-to-git" aria-label="Anchor link for: adding-gnupg-key-id-to-git"><span aria-hidden="true">#</span></a>
</h3>
<p>Next, add the GnuPG key ID to the Git configuration. The ID can be found
in <a href="https://hervyqa.srht.site/blog/configuring-gpg-openssh-for-git/./#viewing-gnupg-key-id">how to view GnuPG key ID</a> in the previous
step.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> config</span><span style="color: #569CD6;"> --global</span><span style="color: #CE9178;"> user.signingkey D7B52C04D9B41849</span></span></code></pre>
<p>If you don’t want to add <code>--gpg-sign</code> manually, you can add this
configuration.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> config</span><span style="color: #569CD6;"> --global</span><span style="color: #CE9178;"> commit.gpgsign</span><span style="color: #569CD6;"> true</span></span></code></pre>
<p>At the same time, if you want to create a tag without manually adding
<code>--gpg-sign</code>.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> config</span><span style="color: #569CD6;"> --global</span><span style="color: #CE9178;"> tag.gpgsign</span><span style="color: #569CD6;"> true</span></span></code></pre>
<p>Additional settings to change the branch name from <code>master</code> to <code>main</code>.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> config</span><span style="color: #569CD6;"> --global</span><span style="color: #CE9178;"> init.defaultBranch main</span></span></code></pre><h3 id="viewing-all-git-configurations">Viewing All Git Configurations<a class="post-anchor" href="#viewing-all-git-configurations" aria-label="Anchor link for: viewing-all-git-configurations"><span aria-hidden="true">#</span></a>
</h3>
<p>If you want to view the configurations that have been set previously,
you can use the command below.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">git</span><span style="color: #CE9178;"> config</span><span style="color: #569CD6;"> --global --list</span></span></code></pre>
<p>The configuration can also be viewed in the <code>~/.config/git</code> directory.
The configuration looks something like this.</p>
<pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #DCDCAA;">cat</span><span style="color: #CE9178;"> ~/.config/git/config</span></span></code></pre><pre class="giallo" style="color: #D4D4D4; background-color: #1E1E1E;"><code data-lang="plain"><span class="giallo-l"><span>[commit]</span></span>
<span class="giallo-l"><span> gpgSign = true</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>[init]</span></span>
<span class="giallo-l"><span> defaultBranch = "main"</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>[tag]</span></span>
<span class="giallo-l"><span> gpgSign = true</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>[user]</span></span>
<span class="giallo-l"><span> email = "work@mail.org"</span></span>
<span class="giallo-l"><span> name = "Hervy Work Email"</span></span>
<span class="giallo-l"><span> signingKey = "D7B52C04D9B41849"</span></span></code></pre><h2 id="in-conclusion">In conclusion<a class="post-anchor" href="#in-conclusion" aria-label="Anchor link for: in-conclusion"><span aria-hidden="true">#</span></a>
</h2>
<p>Thus, the explanation above uses the CLI, which takes longer and is not
instantaneous. Users can use GUI (Client) software for managing GnuPG,
OpenSSH, and Git. However, that is not the purpose here. The hope is
that readers will understand the CLI process and commands so that they
can better understand the process. Of course, increasing literacy in
the use of OpenSSH and Git is very helpful for software development and
programming processes.</p>