# Sign commits with GPG key

**URL:** <https://discourse.nodered.org/t/sign-commits-with-gpg-key/82923>\
**Category:** Feature Requests\
**Created:** [16 November 2023 13:49 UTC](https://discourse.nodered.org/t/sign-commits-with-gpg-key/82923 "2023-11-16T13:49:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![klatka](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/klatka/32/84908_2.png) [@klatka](https://discourse.nodered.org/u/klatka)\
**Post date:** [16 November 2023 13:49 UTC](https://discourse.nodered.org/t/sign-commits-with-gpg-key/82923/1 "2023-11-16T13:49:30Z")

</div>

Hello,

I am facing an issue with GitHub's Vigilant mode which displays my commits via Node-RED as unverified due to their lack of signature. As a feature request, I would like to suggest the possibility of adding GPG keys similar to SSH keys, and if a key is provided, all commits should be automatically signed. To achieve this on my development machine for my other repos, I use the following shell commands:

```auto
git config --global --unset gpg.format
git config --global user.signingkey <keyid>
git config --global commit.gpgsign true

```

Thank you.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [16 November 2023 16:41 UTC](https://discourse.nodered.org/t/sign-commits-with-gpg-key/82923/2 "2023-11-16T16:41:40Z")

</div>

Surely, if you run that in the project's folder, you will get what you want?

---

<div class="post-metadata">

**Author:** ![klatka](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/klatka/32/84908_2.png) [@klatka](https://discourse.nodered.org/u/klatka)\
**Post date:** [17 November 2023 12:09 UTC](https://discourse.nodered.org/t/sign-commits-with-gpg-key/82923/3 "2023-11-17T12:09:13Z")

</div>

I have no access to shell on the machine running node-red

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [17 November 2023 13:49 UTC](https://discourse.nodered.org/t/sign-commits-with-gpg-key/82923/4 "2023-11-17T13:49:34Z")

</div>

Actually, you do - unless whoever is managing Node-RED has blocked the exec command. 😀

---

<div class="post-metadata">

**Author:** ![klatka](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/klatka/32/84908_2.png) [@klatka](https://discourse.nodered.org/u/klatka)\
**Post date:** [6 December 2023 08:52 UTC](https://discourse.nodered.org/t/sign-commits-with-gpg-key/82923/5 "2023-12-06T08:52:29Z")

</div>

```auto
/bin/bash: line 1: gpg: command not found

```

Node-RED is running as a docker container, I cannot change the image or something else.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [6 December 2023 11:45 UTC](https://discourse.nodered.org/t/sign-commits-with-gpg-key/82923/6 "2023-12-06T11:45:18Z")

</div>

You would almost certainly need to know the full path since you probably won't have any of the expected path environment variables set inside the container.

On my Linux system, for example, the `git` command is actually `/usr/bin/git` so try an exec with that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [4 February 2024 11:45 UTC](https://discourse.nodered.org/t/sign-commits-with-gpg-key/82923/7 "2024-02-04T11:45:27Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.