keybase + GitHub で GPG 署名付きコミットにしてみよう

__"キミも明日から Verified !!"__ :lock: 

<img width="327" alt="Screen Shot 2016-04-13 at 11.00.56.png" src="https://qiita-image-store.s3.amazonaws.com/0/1857/8f66453c-37e2-8313-ed53-2fb2eaec4ec3.png">

# 背景

1. [GPG signature verification](https://github.com/blog/2144-gpg-signature-verification) - GitHub Blog
2. [SNSなどと連携できる公開鍵基盤“Keybase”の紹介](http://qiita.com/yyu/items/b444d7a51c30ee071588) - Qiita
3. [GitHubでGPGにより署名されたコミットにバッジが表示されるようになったので設定してみる](http://qiita.com/prince_0203/items/ef0e12f2f6d150ff0485) - Qiita

# 簡易手順書

1. [keybase.io](https://keybase.io/) にアカウント登録
   - 現在は完全招待制
   - 何とかしてinvitation codeを調達してください ><
2. keybaseの手順に沿ってkeybase CLIをダウンロード
	- https://keybase.io/download
	- 更新が激しいので、忘れずに`brew update && brew upgrade keybase` しておくこと
		- e.g. [No help topic for 'encrypt' #2373](https://github.com/keybase/client/issues/2373)
3. GitHubを連携させる (やらなくてもいいかも?)
	- cf. [SNSなどと連携できる公開鍵基盤“Keybase”の紹介](http://qiita.com/yyu/items/b444d7a51c30ee071588)
	- e.g. https://keybase.io/yasulab
	<img width="502" alt="Screen Shot 2016-04-13 at 11.24.09.png" src="https://qiita-image-store.s3.amazonaws.com/0/1857/b328024f-0a03-5825-fbe5-52b1eaeb0259.png">
4. Keybaseのprivate keyをローカルのGPGに追加する
	- cf. [How to import Keybase private key to use locally with GPG
](http://www.keybits.net/2016/02/import-keybase-private-key/)
5. ローカルのGitにGPG keyを追加する
	- cf. [Telling Git about your GPG key](https://help.github.com/articles/telling-git-about-your-gpg-key/) - GitHub Help
6. リモートのGitHubにGPG keyを追加する
	- cf. [Adding a new GPG key to your GitHub account](https://help.github.com/articles/adding-a-new-gpg-key-to-your-github-account/) - GitHub Help
7. 実際にコミットをpushしてみる
	- cf. [Signing commits using GPG](https://help.github.com/articles/signing-commits-using-gpg/) - GitHub Help
8. GitHub上にちゃんと表示されたか確かめる
	- うまくいけば、こんな感じで表示されます :)
	<img width="327" alt="Screen Shot 2016-04-13 at 11.00.56.png" src="https://qiita-image-store.s3.amazonaws.com/0/1857/8f66453c-37e2-8313-ed53-2fb2eaec4ec3.png">


## Note/Tips

> Note: [GitHub Desktop](https://desktop.github.com/) does __not__ support GPG signing.

> Tip: To set all commits for a repository to be signed by default, in Git versions 2.0.0 and above, run `git config commit.gpgsign true`. To set all commits in any local repository on your computer to be signed by default, run `git config --global commit.gpgsign true`.

### FAQ: なんで `You need a passphrase to unlock the secret key for` が表示されるの?

<img width="777" alt="Screen Shot 2016-04-13 at 13.01.22.png" src="https://qiita-image-store.s3.amazonaws.com/0/1857/24581c03-9171-05be-049a-568be482cd55.png">


cf. ["You need a passphrase to unlock secret key for" when encrypting and signing #303](https://github.com/keybase/keybase-issues/issues/303#issuecomment-38173215)

### FAQ: KeybaseにPublic KeyServerってあるの? => まだ無い

<img width="566" alt="Screen Shot 2016-04-13 at 14.28.12.png" src="https://qiita-image-store.s3.amazonaws.com/0/1857/945fd3b0-f5d5-9691-5ae6-e0bdf0572dad.png">


現在議論中。
cf. [Have KeyBase publish itself as a public KeyServer #327](https://github.com/keybase/keybase-issues/issues/327)

## 参考文献

- [GPG signature verification](https://github.com/blog/2144-gpg-signature-verification) - GitHub Blog
- [Keybase Introduces End-To-End Encrypted File Sharing Service](http://techcrunch.com/2016/02/05/keybase-introduces-end-to-end-encrypted-file-sharing-service/) - TechCrunch
- [7.4 Git のさまざまなツール - 作業内容への署名](https://git-scm.com/book/ja/v2/Git-%E3%81%AE%E3%81%95%E3%81%BE%E3%81%96%E3%81%BE%E3%81%AA%E3%83%84%E3%83%BC%E3%83%AB-%E4%BD%9C%E6%A5%AD%E5%86%85%E5%AE%B9%E3%81%B8%E3%81%AE%E7%BD%B2%E5%90%8D) - Pro Git

## Disclaimer

こんな議論もあるので、Keybaseの利用は各自の判断でお願いします :bow: 

- [Trying out Keybase](https://anarc.at/blog/2016-03-10-keybase/)
- [Thoughts on Keybase.io](http://web.archive.org/web/20151005162737/http://blog.lrdesign.com/2014/03/thoughts-on-keybase-io)