0

I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "[email protected]", which I set as my git email. The purpose is to avoid bots doing data scraping or such, collecting my email address from git commits.

I am wondering if I could use my main key to sign git commits (The key uid will be my real email but the git email is the github one). Does that make sense? Will the signature reveal my real email?

Thank you in advance.

1 Answer 1

1

After experimenting with keys and ids I realised the commits cannot be verified if the the email in this signature doesn’t match the committer email. So apparently, the signature exposes it.

Update: I found here that the verification of the committer email against the uid does not come from the signature itself, but from the public key shared with github. So I uploaded the public key with dual uid (real email and github email) and after that, it won't really matter if primary uid of the signing key is not the same as the committer email.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .