title: How to sign git commits from within an IDE like IntelliJ?
body: <blockquote>
    <p><strong>Question</strong> How do I sign git commits using an IDE like IntelliJ on Windows?</p>
  </blockquote>
  
  <p>If you're interested, read what I tried here:</p>
  
  <p>I followed mainly <a href="https://help.github.com/articles/signing-commits-with-gpg/" rel="noreferrer" title="GitHub&#39;s guide">Github's guide</a>. I made sure to not forget to restart bash/IntelliJ after you changed config files.</p>
  
  <ol>
  <li><a href="https://help.github.com/articles/generating-a-new-gpg-key/" rel="noreferrer">Generate a new GPG key pair</a></li>
  <li><a href="https://help.github.com/articles/adding-a-new-gpg-key-to-your-github-account/" rel="noreferrer">Add the GPG key to my GitHub account</a></li>
  <li><a href="https://help.github.com/articles/associating-an-email-with-your-gpg-key/" rel="noreferrer">Associate a verified (by GitHub) email with my GPG key</a> where I made sure the email in my <code>.gitconfig</code> is the same.</li>
  <li><a href="https://help.github.com/articles/telling-git-about-your-gpg-key/" rel="noreferrer">Tell Git about my GPG key</a></li>
  <li><a href="https://help.github.com/articles/signing-commits-using-gpg/" rel="noreferrer">Sign a commit with GPG</a> and confirmed that it was Verfied on Github.</li>
  <li>From that same page, I set commits to be signed by default with <code>git config --global commit.gpgsign true</code> (I'm using git 2.12). I made a new commit and verified it was signed with <code>git verify-commit HEAD</code></li>
  <li><p>When I try to commit in IntelliJ, I get <code>gpg: cannot open tty 'no tty'</code> so I found <a href="https://stackoverflow.com/questions/36557222/intellij-fails-to-commit-changes-when-attempting-to-sign-commit-gpg">IntelliJ fails to commit changes when attempting to sign commit (GPG)</a> and added <code>no-tty</code> to my <code>C:\Users\username\.gnupg\gpg.conf</code> file and restarted. </p></li>
  <li><p>Then I get the error <code>gpg: Sorry, no terminal at all requested - can't get input</code> which seems reasonable because I just added the option that has something to do with no terminal. Like <a href="https://stackoverflow.com/questions/38659198/gpg-sorry-no-terminal-at-all-requested-cant-get-input">gpg: Sorry, no terminal at all requested - can&#39;t get input</a> says the solution is to remove the <code>no-tty</code> which I hope doesn't apply to my case.</p></li>
  <li><p>Other answers in the first question suggested to add <code>use-agent</code> as well in the <code>gpg.conf</code> file, which results in the additional error <code>gpg: gpg-agent is not available in this session</code>. Ah wait, maybe I need to setup gpg-agent.</p></li>
  <li><p>The best guide for Windows that I could find was the <a href="https://wiki.archlinux.org/index.php/GnuPG#gpg-agent" rel="noreferrer">Archlinux wiki</a> (yeah, right). It specifies to add to <code>C:/Users/username/.gnupg/gpg-agent.conf</code> the time to live, so I create that file and add <code>default-cache-ttl 34560000</code> and <code>max-cache-ttl 34560000</code> as per 
  <a href="https://superuser.com/questions/624343/keep-gnupg-credentials-cached-for-entire-user-session">https://superuser.com/questions/624343/keep-gnupg-credentials-cached-for-entire-user-session</a></p></li>
  <li><p>Now let's actually start this gpg-agent, <a href="https://superuser.com/questions/1153101/why-does-git-complain-that-no-gpg-agent-is-running">https://superuser.com/questions/1153101/why-does-git-complain-that-no-gpg-agent-is-running</a> made me check that indeed <code>gpg-agent --version</code> was much newer than <code>gpg --version</code>, so I would like to have gpg2 so I could run <code>git config --global gpg.program gpg2</code>.</p></li>
  <li><p>But I do not have gpg2 available on the command line. I installed <a href="https://gnupg.org/download/" rel="noreferrer">Gpg4win</a> (binary releases, at the bottom) and even Gnupg 2 separately but that didn't give me gpg2 on the command line, I noticed I had to folder GNU in my Program Files (x86) which I think I should have. With <code>where gpg</code> I found out it was at least not pointing to the gpg I just downloaded, because that one showed second. So I pointed git to the right one with <code>git config --global gpg.program 'C:\Program Files (x86)\GnuPG\bin\gpg.exe'</code></p></li>
  <li><p>Now I have the error <code>gpg: skipped "keyid": secret key not available</code>. The solution in <a href="https://stackoverflow.com/questions/42117385/gpg-skipped-n-secret-key-not-available">gpg: skipped &quot;N&quot;: secret key not available</a> is what I just did, so that doesn't help. Then I realised I set everything up with the other gpg, not with this one. I did <code>alias gpg="'C:\Program Files (x86)\GnuPG\bin\gpg.exe'"</code>, checked <code>gpg --version</code> and did the whole thing again. Actually I put the alias line in my <code>.bash_profile</code> so I don't need to run it every time.</p></li>
  <li><p>When I try <code>gpg --gen-key</code> it hangs immediately. No idea why, I don't think the problem is not enough entropy because the older gpg worked fine but it's possible that the newer version requires more entropy. In any case I couldn't find any windows user with the same problem on the Internet.</p></li>
  <li><p>It works! When I commit in IntelliJ, it asks for my passphrase with pinentry only once. But now I can't commit from Git Bash, with the <code>no secret key</code> error which makes sense because as I said <code>gpg --list-keys</code> is empty: no key is associated with this gpg.</p></li>
  <li><p><a href="https://stackoverflow.com/questions/43866966/intellij-idea-signing-git-commits-with-gpg">Intellij IDEA signing GIT commits with GPG</a> is relevant, but the only answer is for MAC and doesn't seem to apply to Windows. It did lead me to:</p></li>
  <li><p><a href="https://me.m01.eu/blog/2015/06/using-gnupg-2-1-x-on-windows" rel="noreferrer">me.m01.eu</a> hints at adding a new environment variable called <code>GNUPGHOME</code> which points to <code>C:\Users\username\.gnupg</code>. That directory exists, but as mentioned in an answer from <a href="https://stackoverflow.com/questions/36810467/git-commit-signing-failed-secret-key-not-available/36811656">git commit signing failed: secret key not available</a> I think my new gpg uses <code>C:\Users\username\AppData\Roaming\gnupg</code> so I added that instead. I checked with <code>printenv GNUPGHOME</code> that I added it correctly (I had to reboot). Didn't change anything though.</p></li>
  <li><p>Since my keys are I think in <code>C:\Users\username\.gnupg</code> I tried pointing the environment variable to there, but it didn't help, <code>gpg --list-keys</code> was still empty. So I had to find another way of pointing out to gpg where my keys are.</p></li>
  <li><p><code>gpg --list-keys --homedir='C:/Users/s156757/.gnupg'</code> did give the correct keys, so I decided to add <code>homedir C:\Users\s156757\.gnupg</code> to my <code>C:\Users\username\AppData\Roaming\gnupg\gpg.conf</code> file which I had to create. Because of <a href="https://lists.gnupg.org/pipermail/gnupg-devel/2005-August/022345.html" rel="noreferrer">this bug</a>. I confirmed <code>gpg --list-keys</code> returned my keys. Still the same error, adding <code>no-tty</code>and <code>use-agent</code> to this conf file didn't help. </p></li>
  </ol>
  
  <blockquote>
    <p>I can now commit from within IntelliJ but not anymore with Git Bash, which results in <code>skipped "keyid": No secret key</code>.</p>
  </blockquote>
  
  <p><strong>More thoughts</strong>  </p>
  
  <ol start="20">
  <li>I didn't manage to export keys from gpg to gpg2 with <code>gpg --export [ID] | gpg2 --import &amp;&amp;
  gpg --export-secret-keys [ID] | gpg2 --import</code></li>
  <li>I thought Gpg4win alone maybe could be configured so I don't need to type my password every time. Unfortunately, I couldn't find anywhere a way to make Gpg4win remember my passphrase.</li>
  <li>I later thought, if I remember correctly <code>gpg --list-secret-keys</code> has never returned anything for gpg 2. I only later found out that that command is different from <code>gpg --list-keys</code>.</li>
  </ol>
  
  <p>In short this is the main problem: gpg-agent allows passphrase caching but the gpg version of git doesn't match the gpg-agent version so you have to install the right gpg 2 yourself first. But I didn't manage to do that installation in such a way that I could commit from both Git Bash and IntelliJ.</p>