Git Keys

To clone and commit to remote repositories in Space, you need credentials that you generate and provide to Space. The type of credentials you'll be asked for depend on the authentication method used in the repository. Refer to the repository Readme file to find out whether you should use SSH or HTTPS to access it and if GPG commit signing is required.

SSH key

An SSH key is required to clone and interact with remote repositories over SSH.

Generate your SSH public key.
On the top left, click your avatar then choose Preferences → Git Keys.
Click Add SSH key...:
Provide your generated key and click Add.

GPG key

GPG (PGP) cryptography adds an extra level of protection to your commits and a repository.

You can use a GPG key to sign your commits locally, and Space will verify your signature in repositories that are configured accordingly adding a Verified label to your commits:

If you are a project administrator, you can configure your repository to verify commit signatures and even prohibit commits that are not signed or verified.

To start signing your commits with a GPG key:

Generate a GPG key.
Add a GPG key to your Space account.
Sign each commit individually or configure your Git client to sign all commits by default.

Generate a GPG key

Download and install the latest version of GnuPG.
Generate a GPG key pair. In your terminal (macOS) or Git Bash (Windows) run:
gpg --full-generate-key
At the prompt, you can accept the default options by pressing Enter.
Provide your identification information: name and email. Make sure the email you enter is associated with your Git client and is verified for your Space account.
Optionally, provide a secure passphrase. You will be asked for it when you sign your commits.
To avoid having to enter your passphrase each time you sign a commit, you can store it using GPG Suite (macOS) or Gpg4win (Windows).
Obtain the fingerprint of the generated key. Run:
gpg --list-keys
and copy the fingerprint:
Export public key. Run the gpg -a --export command followed by the fingerprint:
gpg -a --export F030F0197E045FADTDAE6A2BF9624B12BC7E5EAD
(Substitute the fingerprint in this example with the one you have copied).
Your GPG public key will be displayed.
Copy the GPG public key and save it.

Add a GPG key to your Space account

Log in to Space.
On the top left, click your avatar then choose Preferences → Git Keys.
Click Add GPG Key.
Provide the public GPG key you have saved.

Sign your commits

You can sign each local commit individually or configure your Git client to auto-sign all local commits.

To sign an individual commit:

When making a commit in your local branch, add the -S argument to the git commit command:
git commit -S -am "commit message"
At the prompt, enter the passphrase you created when you generated a GPG key.
A signed commit will be created.
Push your signed commit(s) to your remote Space repository as usual:
git push

To auto-sign all commits in a particular local repository:

In your terminal or Git Bash, navigate to the repository.
Run the following configuration command:
git config commit.gpgsign true
All commits you make in this repository will be signed.

To auto-sign all commits in all local repositories:

Run the following configuration command:
git config --global commit.gpgsign true
All commits you make in any local repository will be signed.

Last modified: 15 December 2023