feat(git): sign using ssh

README.md

@@ -5,7 +5,7 @@
 1. [Generate a new public and private SSH key](https://docs.github.com/en/github/authenticating-to-github/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) by running:
 
    ```zsh
-   curl https://raw.githubusercontent.com/aboqasem/dotfiles/HEAD/ssh.sh | sh -s "<your-email-address>"
+   bash <(curl https://raw.githubusercontent.com/aboqasem/dotfiles/HEAD/ssh.bash) "<your-email-address>"
    ```
 
 2. Clone this repo to `~/dev/dotfiles` with:

ssh.bash

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+# better defaults when dealing with bash scripts: https://gist.github.com/mohanpedala/1e2ff5661761d3abd0385e8223e16425
+set -e          # immediately exit script on any command error
+set -u          # treat unset variables as an error
+set -o pipefail # exit if any piped command fails
+DEBUG=${DEBUG:-}
+if [ -n "$DEBUG" ]; then
+  set -x # print all executed commands to stdout
+fi
+
+EMAIL="${1:?"Usage: $0 <your-email-address>"}"
+
+KEY_TYPE="ed25519"
+KEY_NAME="id_$KEY_TYPE"
+
+echo "Generating a new SSH key for GitHub..."
+
+# Generating a new SSH key
+# https://docs.github.com/en/github/authenticating-to-github/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent#generating-a-new-ssh-key
+ssh-keygen -t "$KEY_TYPE" -C "$EMAIL" -f ~/.ssh/"$KEY_NAME"
+
+# Adding your SSH key to the ssh-agent
+# https://docs.github.com/en/github/authenticating-to-github/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent#adding-your-ssh-key-to-the-ssh-agent
+eval "$(ssh-agent -s)"
+
+{
+  echo "Host github.com"
+  echo " AddKeysToAgent yes"
+  echo " UseKeychain yes"
+  echo " IdentityFile ~/.ssh/$KEY_NAME"
+} >>~/.ssh/config
+
+ssh-add -K ~/.ssh/"$KEY_NAME"
+
+echo "$EMAIL namespaces=\"git\" $(cat ~/.ssh/"$KEY_NAME".pub)" >>~/.ssh/allowed_signers
+
+# Adding your SSH key to your GitHub account
+# https://docs.github.com/en/github/authenticating-to-github/adding-a-new-ssh-key-to-your-github-account
+echo "Run 'pbcopy < ~/.ssh/$KEY_NAME.pub' and paste that into GitHub"

synced/symlink/.gitconfig

@@ -2,6 +2,7 @@
 
 	name = Mohammad Al Zouabi
 	email = [email protected]
+	signingkey = ~/.ssh/id_ed25519.pub
 
 [alias]
 
@@ -142,9 +143,18 @@
 
 [commit]
 
-	# https://help.github.com/articles/signing-commits-using-gpg/
 	gpgsign = true
 
+[gpg]
+
+  # https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#ssh-commit-signature-verification
+  # https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-ssh-key
+	format = ssh
+
+[gpg "ssh"]
+
+	allowedSignersFile = ~/.ssh/allowed_signers
+
 [submodule]
 
 	# Recurse into submodules for every command that has a --recurse-submodules option (except git clone)
@@ -207,3 +217,4 @@
 [init]
 
 	defaultBranch = main
+