New in Tower: GPG Support

What is GPG?

In case these three letters don't tell you much: GPG is a collection of tools that allow signing and encrypting of data using asymmetric cryptography (with public / private keys). Git uses GPG to sign and verify commits and tags. With such a signature, you can easily verify that a commit (or tag) was really made by a specific user.

What Can You Do With GPG in Tower?

We worked hard on bringing you a seamless integration of GPG in Tower. Here are some of the things that are now possible, right from within Tower.

Verifying Signed Commits

Tower now indicates directly in its History views if a commit was signed or not. On top of that, you can also see the signature status (green / orange / red) and access additional information through a popover window. Very easy, very quick!

Verifying Signed Tags

Apart from commits, you can also verify the signatures for tags in Tower. Either right-click on the tag in the sidebar or directly click it in one of the commit views.

Setting & Managing Keys

Keys are at the core of GPG. That's why we made it easy to select / set / switch keys in Tower:

• in the global configuration, in Tower's Preferences dialog
• in a specific repository, by selecting the "Settings" item in the sidebar of an open repository
• in our new "User Profiles", which we just released a couple of weeks ago

Signing Commits

You can configure if you want Tower to automatically sign new commits - either just in a certain repository or globally. This is not limited to just committing, but also includes actions like merge, revert, cherry-pick, and rebase.

Signing Tags

Apart from commits, you can also sign tags. The "Create New Tag" dialog contains a checkbox for this.

Learn More

If you want to know more - from setting up GPG in Tower all the way to some troubleshooting tips - you can hop over to our Help Docs on GPG.

If you haven't already, make sure to download our free trial today and take the new Tower for a spin!