(One test to know whether you truely understand something is by trying to explain it. Please be aware I don’t truely understand GPG)

If you read my last post on GitHub commits you will probably be completely unsurpised that I (sometimes) sign my commits now. I mainly do gpg signing at work using a YubiKey. The way I have it setup is I created a subkey, and exported that subkey to my YubiKey. I also put an expiration of 3 months on my subkey. The idea being that, if you don’t do this often enough you’ll forget about it.

Soooo 3 months later and (surprise) I definitely forgot how I update my expired subkey. I eventually figured it out, so here it goes:

1. Take your YubiKey and put it aside
2. Go to your machine that has the master key.
3. run gpg2 --edit-key cesar
4. Select the key you want to update: key 514EBCC933245B8E
5. Type expire and follow the prompts
6. Export your key with the new expiration dates gpg2 --export cesar
7. Import your key into your work computer

I spent a lot of time between steps 4 and 5. My understanding was that my GPG key was on the YubiKey, and I was trying to import the key into the YubiKey. This is not true. My signing private key is on the YubiKey. It does not have the concept of expiration.

I recently updated my blog url and it required making a change in GitHub because that’s where my blog is hosted (using the excellent GitHub pages). Basically you need to update your DNS and make some changes to the project settings.

However I noticed some interesting commits in my repository:

All the commits show as coming from my name or cdolivei (my GitHub commit handle). There are 2 ways that I commit to my repository:

1. I use the git command line
2. I create blog posts using the in-browser editor - which is helpful because it gives a rendered preview of Markdown

However three of the commits, which shows as coming from cdolivei, I did not explicitly commit. All three are around the CNAME change.

GitHub is doesn’t really mention doing this both on the project settings page and in their custom domain docs, but basically when you add/modify the custom domain setting in the project settings page, it automatically add/updates the CNAME file in the repository. While this is a user experience improvement over creating the file yourself, if I was to ask people “How often should GitHub make a commit in your repository on your behalf?” the answer for most people would probably be never.

Maybe the solution is to start signing my commits? :(

GitHub is very popular and a trusted source for millions of projects, and to me, even though the commit is harmless, errodes that trust.

We believe peace begins within (x2)

Oh me, oh my
Cost of living get so high
My my, what now
Got to make it
Don’t know how

We believe peace begins within (x2)

Don’t like war
Give us peace
Won’t you excuse me while I get my release
Oh me, oh my
Things so bad
I cannot cry

We believe peace begins within (x2)

Oh me, oh my
Want to see heaven
But I don’t want to die

We believe peace begins within (x2)

- Peace Begins Within by Nora Dean [Youtube]