GPG keys

Trylle associates an ASCII-armored GPG public key with your account so signed commits and tags can be shown as verified.

Install GnuPG

brew install gnupg

Generate and export a key

gpg --quick-generate-key "you@example.com" ed25519 sign
gpg --list-secret-keys --keyid-format=long
gpg --armor --export KEY_ID

Enter a passphrase when prompted. Copy the key ID from the sec line, then export and copy the complete block from BEGIN PGP PUBLIC KEY BLOCK through END PGP PUBLIC KEY BLOCK.

Add and verify the key

1. Open Settings → GPG keys → New GPG key.
2. Paste the exported public-key block and continue.
3. If verification is required, Trylle shows a one-time token and an OS-specific signing command.
4. Run the displayed command with the matching private key.
5. Paste the resulting ASCII-armored signature and choose Verify key.

Verification proves control of the private key without uploading it.

Configure Git signing

git config --global user.signingkey KEY_ID
git config --global commit.gpgsign true
git config --global tag.gpgsign true

On macOS terminals, add this to your shell configuration if signing cannot open the passphrase prompt:

export GPG_TTY=$(tty)

Confirm locally

git commit --allow-empty -S -m "chore: verify commit signing"
git log --show-signature -1

Push the commit and confirm Trylle shows the signature as verified. The email identity in the key should match a verified email on the account.