|
| 1 | +--- |
| 2 | +title: Adding a GPG key to your GitHub account |
| 3 | +intro: 'To configure your account on {% ifversion ghae %}{% data variables.product.product_name %}{% else %}{% data variables.product.product_location %}{% endif %} to use your new (or existing) GPG key, you''ll also need the key to your account.' |
| 4 | +redirect_from: |
| 5 | + - /articles/adding-a-gpg-key-to-your-github-account |
| 6 | + - /github/authenticating-to-github/adding-a-new-gpg-key-to-your-github-account |
| 7 | + - /github/authenticating-to-github/managing-commit-signature-verification/adding-a-new-gpg-key-to-your-github-account |
| 8 | + - /articles/updating-an-expired-gpg-key |
| 9 | + - /authentication/troubleshooting-commit-signature-verification/updating-an-expired-gpg-key |
| 10 | + - /github/authenticating-to-github/updating-an-expired-gpg-key |
| 11 | + - /github/authenticating-to-github/troubleshooting-commit-signature-verification/updating-an-expired-gpg-key |
| 12 | + - /authentication/managing-commit-signature-verification/adding-a-new-gpg-key-to-your-github-account |
| 13 | +versions: |
| 14 | + fpt: '*' |
| 15 | + ghes: '*' |
| 16 | + ghae: '*' |
| 17 | + ghec: '*' |
| 18 | +topics: |
| 19 | + - Identity |
| 20 | + - Access management |
| 21 | +shortTitle: Add a GPG key |
| 22 | +--- |
| 23 | + |
| 24 | +## About addition of GPG keys to your account |
| 25 | + |
| 26 | +To sign commits associated with your account on {% data variables.product.product_name %}, you can add a public GPG key to your personal account. Before you add a key, you should check for existing keys. If you don't find any existing keys, you can generate and copy a new key. For more information, see "[Checking for existing GPG keys](/articles/checking-for-existing-gpg-keys)" and "[Generating a new GPG key](/articles/generating-a-new-gpg-key)." |
| 27 | + |
| 28 | +You can add multiple public keys to your account on {% data variables.product.product_name %}. Commits signed by any of the corresponding private keys will show as verified. If you remove a public key, any commits signed by the corresponding private key will no longer show as verified. |
| 29 | + |
| 30 | +{% ifversion upload-expired-or-revoked-gpg-key %} |
| 31 | +To verify as many of your commits as possible, you can add expired and revoked keys. If the key meets all other verification requirements, commits that were previously signed by any of the corresponding private keys will show as verified and indicate that their signing key is expired or revoked. |
| 32 | + |
| 33 | + |
| 34 | +{% endif %} |
| 35 | + |
| 36 | +{% data reusables.gpg.supported-gpg-key-algorithms %} |
| 37 | + |
| 38 | +When verifying a signature, {% data variables.product.product_name %} extracts the signature and attempts to parse its key ID. The key ID is then matched with keys added to {% data variables.product.product_name %}. Until a matching GPG key is added to {% data variables.product.product_name %}, it cannot verify your signatures. |
| 39 | + |
| 40 | +## Adding a GPG key |
| 41 | + |
| 42 | +{% data reusables.user-settings.access_settings %} |
| 43 | +{% data reusables.user-settings.ssh %} |
| 44 | +3. Click **New GPG key**. |
| 45 | +  |
| 46 | +4. In the "Key" field, paste the GPG key you copied when you [generated your GPG key](/articles/generating-a-new-gpg-key). |
| 47 | +  |
| 48 | +5. Click **Add GPG key**. |
| 49 | +  |
| 50 | +6. To confirm the action, enter your {% data variables.product.product_name %} password. |
| 51 | + |
| 52 | +{% ifversion upload-expired-or-revoked-gpg-key %} |
| 53 | +{% else %} |
| 54 | +## Updating an expired GPG key |
| 55 | + |
| 56 | +When verifying a signature, {% data variables.product.product_name %} checks that the key is not revoked or expired. If your signing key is revoked or expired, {% data variables.product.product_name %} cannot verify your signatures. |
| 57 | + |
| 58 | +If your key is expired, you must [update its expiration](https://www.gnupg.org/gph/en/manual.html#AEN329), export the new key, delete the expired key in your account on {% data variables.product.product_name %}, and add the new key to your account as described above. Your previous commits and tags will show as verified, as long as the key meets all other verification requirements. |
| 59 | + |
| 60 | +If your key is revoked, use the primary key or another key that is not revoked to sign your commits. |
| 61 | + |
| 62 | +If your key is invalid and you don't use another valid key in your key set, but instead generate a new GPG key with a new set of credentials, then your commits made with the revoked or expired key will continue to show as unverified. Also, your new credentials will not be able to re-sign or verify your old commits and tags. |
| 63 | +{% endif %} |
| 64 | + |
| 65 | +## Further reading |
| 66 | + |
| 67 | +- "[Checking for existing GPG keys](/articles/checking-for-existing-gpg-keys)" |
| 68 | +- "[Generating a new GPG key](/articles/generating-a-new-gpg-key)" |
| 69 | +- "[Telling Git about your signing key](/articles/telling-git-about-your-signing-key)" |
| 70 | +- "[Associating an email with your GPG key](/articles/associating-an-email-with-your-gpg-key)" |
| 71 | +- "[Signing commits and tags using GPG keys](/articles/signing-commits-and-tags-using-gpg)" |
| 72 | +- "[About commit signature verification](/articles/about-commit-signature-verification)" |
0 commit comments