Securing Your Developer Machine: SSH Keys, GPG Signing & Credential Storage

Why Developer Workstation Security is Critical

Software developers possess elevated access: API keys, production database credentials, server SSH access, and repository write permissions. If an engineer's workstation is compromised, unauthorized code can enter the deployment pipeline. Securing your development environment protects both you and your users.

1. Generate Modern Ed25519 SSH Keys (Retire RSA 2048)

Ed25519 provides superior cryptographic strength, faster handshakes, and smaller key sizes compared to legacy RSA:

# Generate a secure Ed25519 key with a passphrase
ssh-keygen -t ed25519 -C "developer@jmdworld.in"

# Start the SSH agent and register the key
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Copy your public key (cat ~/.ssh/id_ed25519.pub) and register it inside GitHub > Settings > SSH and GPG keys.

2. Configure GPG Commit Signing on GitHub

Anyone can configure their local Git email to impersonate another committer. GPG signing guarantees cryptographic identity, showing the green "Verified" badge on GitHub commits.

# Generate GPG key
gpg --full-generate-key
# Select: (1) RSA and RSA, 4096 bits, does not expire

# Export public key for GitHub
gpg --armor --export <KEY_ID>

# Configure Git to automatically sign all commits
git config --global user.signingkey <KEY_ID>
git config --global commit.gpgsign true

3. Use Native Credential Managers (Never Hardcode Passwords)

# On Windows
git config --global credential.helper manager

# On macOS
git config --global credential.helper osxkeychain

Always verify that .env and *.keystore files are added to your global .gitignore to prevent accidental credential leaks.