Verify your commits on Codeberg with a green badge.

Important: You do everything in Terminal. All commands below are for Terminal.

Homebrew

Homebrew is a program that installs other programs on your Mac. If you need something like git or gnupg, Homebrew can install it with one command. You don’t need to download files manually or drag them into folders. Homebrew does it for you.

How to install Homebrew:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

The script will show you what it will do and ask for permission. After install, follow the instructions on screen. Then check if it works with brew doctor.

GnuPG

GnuPG is a tool for encryption and digital signatures. With Git, you use it to sign your commits and tags. Codeberg will show a green “Verified” badge next to your commits. This proves that the commit really came from you, not from someone pretending to be you.

How to install GnuPG and pinentry-mac together:

brew install gnupg pinentry-mac

pinentry-mac is a small window where you type your password safely. Without it, GnuPG asks for your password inside Terminal. That is not convenient and sometimes fails.

Set up pinentry-mac manually — this works every time:

mkdir -p ~/.gnupg
chmod 0700 ~/.gnupg
echo "pinentry-program $(brew --prefix)/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf
gpgconf --kill gpg-agent

How to add your existing GPG key to GnuPG

You already have a GPG key. It is in a file (for example, a backup from another computer). You do NOT need to make a new key. Just import your old key.

Import your key:

gpg --import ~/path/to/your/private-key.asc

GnuPG imports both the private key and the public key from the same file. You don’t need to import the public key separately.

Check that the key was added:

gpg --list-secret-keys --keyid-format LONG

You will see something like this:

sec   rsa4096/3AA5C34371567BD2 2024-01-01 [SC]
      ...
uid                 [ultimate] Your Name <your@email.com>

Copy the key ID — that is the part after rsa4096/ (in the example: 3AA5C34371567BD2).

Set up Git

Tell Git which key to use and turn on automatic signing for commits and tags:

git config --global user.signingkey 3AA5C34371567BD2   # your key ID
git config --global commit.gpgsign true                # sign all commits
git config --global tag.gpgSign true                   # sign all tags

Make sure the email in Git matches the email in your key:

git config user.email
gpg --list-keys --keyid-format LONG

If the emails do not match, the signature will NOT be verified. Fix it:

git config --global user.email "your@email.com"

Saving passwords in Keychain

On macOS, pinentry-mac often offers to save your password in Keychain. The “Save in Keychain” checkbox is sometimes checked automatically. If you don’t notice it, your password gets saved. After that, pinentry stops asking for your password. This is convenient but less secure. Anyone with access to your computer can sign commits as you.

How to remove a saved password:

  1. Open “Keychain Access” (it is in /Applications/Utilities/).
  2. Type gpg or pinentry in the search box.
  3. Find the entry for your GPG key or pinentry-mac.
  4. Delete it (right-click → Delete, or press Delete on your keyboard).

After this, pinentry-mac will ask for your password again next time you sign a commit.

How to NOT save the password in the future: Just uncheck “Save in Keychain” every time you type your password.