Configure Commit Signing on Windows with Your CAC

Overview

This article explains what commit signing is and how to configure your Windows machine to sign Git commits with your CAC.

All commits must be signed using either a CAC or a GPG key. Developers with a CAC can configure Git to sign commits using their CAC certificate. For projects operating in IL4 and IL5 environments, CAC signing is required for all commits.

If you do not use a CAC for commit signing, follow the How to Commit Sign with GPG Guide.

WARNING

Party Bus does not support commit signing through IDE integrations. If you create commits in an IDE, use the command line to sign them. Do not submit Party Bus support requests for IDE-specific commit signing issues.

Prerequisites

Before you begin:

1. Open the Windows terminal using PowerShell.

   • If your default profile is not PowerShell, open a new tab and select PowerShell.

2. Install Git and S/MIME Sign.

   winget install Git.Git
   winget install GitHub.smimesign

3. Add S/MIME Sign to the system PATH environment variable.
   Open PowerShell as an administrator and run:

   [Environment]::SetEnvironmentVariable("PATH", $Env:PATH + ";C:\Program Files\smimesign", [EnvironmentVariableTarget]::Machine)
   
   $env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine")

4. Verify that Git and S/MIME Sign are installed.

   git --version 
   smimesign --version

Identify Your CAC Signing Certificate

Before you configure Git commit signing, identify the Digital Signature certificate on your CAC and record its certificate thumbprint. You will use this value as your signing key later in this procedure.

1. Locate the CAC signing certificate. Windows identifies this certificate as Document Signing.
   Run the following command in PowerShell:

   Get-ChildItem Cert:\CurrentUser\My\ -EKU "Document Signing"

2. Verify that a certificate is returned. If no certificate is found, verify that:

   • Your CAC is inserted and recognized by Windows.
   • Your CAC contains a Document Signing certificate.

3. Save the certificate thumbprint.

   $thumbprint = (Get-ChildItem Cert:\CurrentUser\My\ -EKU "Document Signing").Thumbprint

   The $thumbprint variable stores the certificate thumbprint for the current PowerShell session.

4. Display and record the thumbprint value.

   $thumbprint

   You will use this value as your signing key in the next section.

Confirm Your GitLab Commit Email Address

After identifying your CAC signing certificate, verify that your GitLab commit email matches it.

1. Open User Settings > Emails .
2. Find the email address marked with the icon.
3. Verify that the commit email matches the email address on your CAC signing certificate.

If the correct email address is not listed:

1. Submit a request for GitLab commit sign email validation .

   • For repo1.dso.mil, contact the Iron Bank team instead.

2. Wait until the request is complete.

3. Open User Settings > Profile.

4. Select the newly added CAC CDS email address as your Commit Email.

   WARNING

   Do not add the email address to GitLab yourself. User-added email addresses require email verification, but GitLab on P1 cannot send verification emails. The email address must be added and verified through the service request.

   If multiple developers need commit email validation, submit a single request that includes all users. If the team is not yet in the pipeline queue, add the information to the COT Epic in Jira.

Configure Git

Configure Git to use your CAC certificate when signing commits. If you already have Git configured for other accounts or repositories, adjust these steps as needed.

Replace <DoD Email Address> with the email address associated with your CAC. Replace <THUMBPRINT> with the certificate thumbprint you recorded in the previous section.

1. Check your existing Git email configuration.

   git config --get user.email

2. Configure your Git user identity.

   git config --global user.email "<DoD Email Address>"
   git config --global user.name "<Firstname Lastname>"

3. Configure Git to sign commits using your CAC certificate.

   git config --global user.signingkey <THUMBPRINT>
   git config --global gpg.x509.program smimesign
   git config --global gpg.format x509
   git config --global commit.gpgsign true

4. Verify the Git configuration.

   git config --list | Select-String -Pattern 'user|gpg|commit'

Confirm the output includes:

• Your CAC-associated email address.
• Your certificate thumbprint.
• smimesign for gpg.x509.program.
• x509 for gpg.format.
• true for commit.gpgsign.

Related Content/References

Submit Requests to the Help Desk

• Request GitLab commit sign email validation

Review Supporting Documentation

• Learn how to use x509-signed commits in GitLab projects
• Review the OpenSC Wiki
• Review the Git configuration documentation