configuration - Sign git commit with x509 certificate in corporate environment

Question

I have learned from the documentation that it is possible to sign git tags and commits.

git config --global user.signingkey 0A46826A

Docs: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

This works for GPG. Has somebody done something like this with X509 user certificates?

It looks like GPG is not compatible or interchangeable with x509 pki certificates. Since this is in a corporate environment GPG is not a option.

It would be great if somebody could share thoughts or experiences how this could be done with x509 certs? What would be required and what it takes to implement something like this?

Answer 1

GitHub provides some helpful instructions on specifying signing keys including how to sign using X.509 certificates using smimesign on Windows and Mac.

For Git versions 2.19 and newer

$ git config --global gpg.x509.program smimesign
$ git config --global gpg.format x509

For Git versions 2.18 and older

$ git config --global gpg.program smimesign

On Linux you can use gpgme instead. Add your certificate with gpgme --import cert.p12. You may also need to import the root and any intermediate certificates before gpgme will let you sign anything.