13

I'd like to publish my .gitconfig file on GitHub, which includes a signing key.

As far as I understand, since this is related to code signing, the key referenced there is the ID of my private GPG key.

How safe is it to share it with the world?

2
  • I dont know about git and code signing. But as long as it is only the public key (or anything derived from it, e.g. a SHA fingerprint), its 100% safe. Also, i think that setting should belong in your global gitconfig, not in a project-related one.
    – marstato
    Commented Mar 11, 2017 at 23:18
  • Thanks a lot @marstato. This is on my global gitconfig, which I was looking to publish as part of my "dot files".
    – jviotti
    Commented Mar 12, 2017 at 16:33

1 Answer 1

19

Is it safe to share your gitconfig's user.signingkey value with the world?

Yes, that is safe.

The signingkey value is your GPG key ID (the lower 64 bits of the fingerprint) which is derived from your public key and does not carry any secret information. Therefore you can publish it to the same extent you would publish your public key. (Instead of the shorter key ID, you could also use the full fingerprint for the signingkey value.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .