The terminal waits with a blinking cursor. Your new hire logs in for the first time. Their access is blocked until they pass the GPG onboarding process.
GPG onboarding is the step-by-step method of creating, verifying, and distributing a new developer’s GPG key so they can sign commits, encrypt data, and share secrets within a secure workflow. Without it, commits show as unverified, code reviews slow, and private messages risk interception. A fast, repeatable onboarding process removes bottlenecks and prevents security drift.
Start by installing GPG on the developer’s machine. Modern distros ship with GPG pre-installed, but confirm the version with gpg --version. Outdated builds miss security patches and may fail when importing newer keys.
Generate a key pair:
gpg --full-generate-key
Choose RSA 4096 for strong encryption, set a reasonable expiration, and protect it with a passphrase. The email address should match the one used for Git commits and internal identity systems.
Verify the key by listing it:
gpg --list-secret-keys --keyid-format=long
Export the public key and send it to the team’s keyserver or paste it into the organization’s Git hosting platform profile.
gpg --armor --export <KEY_ID>
This step ensures commit-signing can be validated by the CI/CD pipeline and by all team members.
Set Git to use the new key:
git config --global user.signingkey <KEY_ID>
git config --global commit.gpgsign true
Test with a signed commit. Push to a test branch and confirm the commit shows as “verified” in the repository UI.
For remote onboarding, require a short verification session. This can be a quick video call where the key fingerprint is read aloud and matched against what’s in the team’s records. This mitigates man-in-the-middle attacks during key exchange.
Storage policies matter. Outline where private keys are kept, whether hardware tokens are used, and how revocations are handled. Publish the process in an internal doc so future onboardings are identical and auditable.
A well-run GPG onboarding process doesn’t just add a key. It sets the baseline for trust in your codebase. Run it fast, run it clean, and enforce it every time.
See how hoop.dev can automate and streamline your GPG onboarding process—live in minutes.