Avatar
18 February 2025

Signing Git commits using 1Password

This guide walks through setting up Git commit signing using SSH keys stored in 1Password. This method allows you to sign commits without GPG, using your SSH key and biometric authentication.

This guide is only for macOS.

Prerequisites

  • Git version 2.34.0 or later
  • 1Password desktop app
  • 1Password SSH agent enabled
  • SSH key generated or imported into a 1Password vault.

Setup Steps

1. Configure SSH Agent

Create or edit ~/.config/1Password/ssh/agent.toml:

[[ssh-keys]]
vault = "Your-Vault-Name"
item = "Your-SSH-Key-Name"

Replace Your-Vault-Name and Your-SSH-Key-Name with your actual vault and SSH key item names.

2. Configure Git

Edit ~/.gitconfig:

[user]
  signingkey = ssh-ed25519 YOUR_PUBLIC_KEY_HERE
  email = your.email@example.com

[gpg]
  format = ssh

[gpg "ssh"]
  program = "/Applications/1Password.app/Contents/MacOS/op-ssh-sign"

[commit]
  gpgsign = true

Replace:

  • YOUR_PUBLIC_KEY_HERE with your SSH public key
  • your.email@example.com with your email

3. Set Up Local Signature Verification

  1. Create directory for allowed signers:
mkdir -p ~/.config/git
  1. Create allowed signers file:
nano ~/.config/git/allowed-signers
  1. Add your signing information:
your.email@example.com ssh-ed25519 YOUR_PUBLIC_KEY_HERE
  1. Configure Git to use the allowed signers file:
git config gpg.ssh.allowedSignersFile '~/.config/git/allowed-signers'

4. Register SSH Key with GitHub/GitLab

GitHub

  1. Go to GitHub SSH key settings
  2. Add your SSH key
  3. Set key type to “Signing key” (or both authentication and signing)

GitLab

  1. Go to GitLab SSH key settings
  2. Add your SSH key
  3. Set usage type to “Authentication & Signing” or “Signing”

Usage

Making Signed Commits

Your commits will automatically be signed if you’ve set commit.gpgsign = true. Otherwise, use the -S flag:

git commit -S -m "Your commit message"

Verifying Signatures

Check commit signatures:

git log --show-signature

Troubleshooting

Unsupported SSH Format

If you see:

error: gpg.format has an unsupported value

Verify your Git version is 2.34 or later:

git --version

Failed Commits

If commits fail with:

error: invalid key: <YOUR_KEY>

or

error: commit missing -S option, and commit.gpgsign is not set

Verify your signing key configuration:

git config user.signingkey

Unverified Commits

If commits aren’t showing as verified, check:

  1. Email matches between Git config and GitHub/GitLab
  2. SSH key is properly registered as a signing key
  3. No local Git config overrides:
git config --local user.signingkey
git config --show-origin user.signingkey

Allowed Signers Error

If you see:

error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification

Verify your allowed signers file exists and is properly configured.

Tips

  • You can use the same SSH key for both authentication and signing
  • For multiple signing setups, use Git’s includeIf directive
  • Keep your Git client updated to ensure SSH signing support
  • Use 1Password browser extension to easily fill SSH keys when registering with GitHub/GitLab