Code change:
VS Code should optionally be able to sign git commits with a given GPG key, as it is a good practice for authorization nowadays.
Doesn't GitHub's authentication basically do the same thing, since you need to auth with GitHub to push to repos you have access to?
GitHub auth is NOT related to GPG-signed commits if I know right.
Basically, I would like built-in functionality for appending the command line argument to , as shown .
Sure, but isn't what it's accomplishing done by GitHub account/email linking? You need to link your email to an account and need credentials to the account to push.
GPG can be used in any git environment (for instance: GitLab, BitBucket, etc.) I though this could be actual after seeing the .
thoughts?
I'd argue that for any given repo, you'd either want to sign all commits or none. Based on that, I suggest to use the git configuration in your repo, , which will make git sign all commits by default. Does that work for you
I use exactly that, but when I try to commit from VS Code with that config attribute set, I get the following error output in the Git console of Code:
I misread the issue, I thought you were talking about the vscode repo starting to sign commits, not adding the feature. while looking into signing commits yesterday, this I came across this
Not just vscode is affected: If you're using an agent: As a workaround (a configuration change affecting not just vscode) it's possible to add to your For example, run Snippet from explaining : From what I've noticed, is now less verbose (doesn't remind me that I "need my passphrase" on ; is completely silent on ). I don't know what else this affects and thus I feel bad for suggesting this, but it works. If you're not using an agent: Again referring to Launchpad, you seem to be out of luck.
Thanks for that Does it solve it for you,
Well, having listened to I'm not signing my commits anymore, but thank you for all the help provided!
. It is not strictly accurate that signing each commit is "totally stupid."
it would be nice if vscode gave me the opportunity to sign a commit.
Signing commits is not "totally stupid" and, in fact, has very real security implications. Not all Git code happens to be "pushed" to Github or BitBucket. Many places use git internally for all sorts of things and git commit signing is a very needed feature and often a requirement. I am using a gpg-agent and still am unable to sign commits in VSCode, for what it's worth.
I found the two places that need to be modified for this to work, but wasn't able to setup the vscode repository properly (not able to run tests, linter hangs, unable to run electron) so I just dropped it. I'm leaving the links to the lines here in hope that someone will pick it up, and soon Funny thing is they both do the same thing, and they are both nearly identical, but one is written in async/await and the other uses plain function arguments instead of an options object. Is there a reason for this? Why not just abstract it out as another module and use it through that, would be less hassle maintaining it (and any similar parts that can be solved via the same solution).
^ seems that git support is divided into two parts - one is git workbench that's in and second is git extension (that's built-in?) Is there any progress on this?
i dont there is any work going on yet. I will pick this up but not until this weekend
I like to confirm I am starting work on this. I will a pull request with a WIP title to show progress soon
Hello here, I recently tried committing with set to . However the issue I encountered is related to my name: it contains an accented 'e' (é) and right now VSCode seems to have some encoding problem (at least with git): ! Which prevents git from detecting the correct GPG key.
Hi! Any progress updates? :)
got all the changes needed mapped now going to add menus items etc should be done soon just lots of test and things to write
I have the change almost complete just tidying up and getting ready to commit.
Pull request Added support to GPG signing hope all is oke
would love to see this.
Me too, it was to the June milestone that got me excited but now its back in the backlog.... So I don't know whats going on. The pull request is this one:
Please, that comment, which is purely subjective, is very old and it's quoting achieves nothing, but FUD. Impersonating authors on GitHub is easily done and signing ALL commits is good practice. Especially with hardware tokens, such as Yubikeys. I mean no harm with , I am merely showing how easy it is to submit a commit by another. I feel GitHub could do more here too. On the main page, images are small and easily distracted (I could even change mine, I guess ... and my name). But the "Verified" means we've signed that commit. I believe it's important, as others seem to have commented also. !
I verify ALL my commit is important and we do use yubikeys here at my organisation
GPG signing provides authentication on the commits themselves. What you said in and subsequent comments are irrelevant to the issue. Because without signing the commit, I can easily fake you as the author and submit a fraudulent patch (e.g. intentionally infringing copyright of your rival company) via other channels (e.g. email) to another committer, who will be having a hard time to know whether you actually wrote the patch or not. And if that committer push the CL to GitHub, GitHub will happily link that to your account. See this commit for example:
Hi all, no need to try to convince me anymore
YEAHHHHH!
This error git commit --quiet --allow-empty-message --file - --all git show gpg: cannot open tty `no tty': No such file or directory error: gpg failed to sign the data fatal: failed to write commit object can be cause by password protected gpg key.
something related to the error you seen:
I got it to work for me, but only after signing a previous commit (~5 minutes prior) manually through the integrated terminal. I have a hunch that the root cause of the error message , is that VS Code is requesting to open the prompt, and failing to do so. If you already entered your password via prompt previously, VS Code signs the commits perfectly fine.
You'll probably want to use a pinentry program that remembers the pass code or prompts graphically. (sorry if terse) On Tue, 17 Oct 2017, 08:33 Jeremy Loy, <:
usually you see this problem when you dont things set up properly for gpg signing. that has been my experience
In Linux, I solve /dev/tty problem by adding binary exec of gpg2 path to git global config

Related discussion:
text: } } <del> async commit(message: string, opts: { all?: boolean, amend?: boolean, signoff?: boolean } = Object.create(null)): Promise<void> { </del> <ins> async commit(message: string, opts: { all?: boolean, amend?: boolean, signoff?: boolean, signCommit?: boolean } = Object.create(null)): Promise<void> { </ins> const args = ['commit', '--quiet', '--allow-empty-message', '--file', '-']; if (opts.all) {