# Git commit signing with onlykey-agent

**URL:** <https://onlykey.discourse.group/t/git-commit-signing-with-onlykey-agent/1114>\
**Category:** SSH, OpenPGP, GPG\
**Created:** [June 24, 2023, 2:54pm UTC](https://onlykey.discourse.group/t/git-commit-signing-with-onlykey-agent/1114 "2023-06-24T14:54:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ian](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@Ian](https://onlykey.discourse.group/u/Ian)\
**Post date:** [June 24, 2023, 2:54pm UTC](https://onlykey.discourse.group/t/git-commit-signing-with-onlykey-agent/1114/1 "2023-06-24T14:54:29Z")

</div>

I’m using the onlykey-agent with SSH for git. It works fine for SSH (git pull/push etc) but not for signing commits.

I generated a public key with:

```bash
onlykey-agent identity@myhost > ~/.ssh/identity@myhost.pub

```

I have configured git:

```plaintext
[user]
       email = EMAIL
        name = NAME
  signingkey = ~/.ssh/identity@myhost.pub
[commit]
  gpgsign = true
[tag]
  gpgsign = true
[gpg]
  format = ssh

```

Git pushes/pulls etc work fine but when I try and sign a commit I get a fail:

```bash
$ onlykey-agent identity@myhost -- git commit -m "commit message"

2023-06-24 15:42:53,329 ERROR signature with "<ssh://identity@myhost|ed25519>" key failed [protocol.py:152]
Traceback (most recent call last):
  File "/home/user/.local/lib/python3.11/site-packages/libagent/ssh/protocol.py", line 148, in sign_message
    signature = self.conn.sign(blob=blob, identity=key['identity'])
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.local/lib/python3.11/site-packages/libagent/ssh/ __init__.py", line 246, in sign
    return conn.sign_ssh_challenge(blob=blob, identity=identity)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.local/lib/python3.11/site-packages/libagent/ssh/client.py", line 48, in sign_ssh_challenge
    msg['user'].decode('ascii'), identity.to_string(),
    ~~~^^^^^^^^
KeyError: 'user'
error: Signing file /tmp/.git_signing_buffer_tmppiE3DO
Couldn't sign message (signer): communication with agent failed?
Signing /tmp/.git_signing_buffer_tmppiE3DO failed: communication with agent failed?

2023-06-24 15:42:53,330 WARNING error: 'user' [server.py:100]
Traceback (most recent call last):
  File "/home/user/.local/lib/python3.11/site-packages/libagent/server.py", line 95, in handle_connection
    reply = handler.handle(msg=msg)
            ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.local/lib/python3.11/site-packages/libagent/ssh/protocol.py", line 106, in handle
    reply = method(buf=buf)
            ^^^^^^^^^^^^^^^
  File "/home/user/.local/lib/python3.11/site-packages/libagent/ssh/protocol.py", line 148, in sign_message
    signature = self.conn.sign(blob=blob, identity=key['identity'])
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.local/lib/python3.11/site-packages/libagent/ssh/ __init__.py", line 246, in sign
    return conn.sign_ssh_challenge(blob=blob, identity=identity)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.local/lib/python3.11/site-packages/libagent/ssh/client.py", line 48, in sign_ssh_challenge
    msg['user'].decode('ascii'), identity.to_string(),
    ~~~^^^^^^^^
KeyError: 'user'
fatal: failed to write commit object

```

Am I doing this right or is there a problem in my setup? Thanks.

---

<div class="post-metadata">

**Author:** ![Ian](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@Ian](https://onlykey.discourse.group/u/Ian)\
**Post date:** [June 26, 2023, 1:13pm UTC](https://onlykey.discourse.group/t/git-commit-signing-with-onlykey-agent/1114/2 "2023-06-26T13:13:53Z")

</div>

Answering myself it was fixed in Jan this year by activescott: [fix: eleminates error when using SSHSIG when using onlykey-agent](https://github.com/onlykey/lib-agent/pull/9)

But there’s been no release since the fix was merged unfortunately.

So instead I’ve applied that fix manually, i.e. adding these two lines to `site-packages/libagent/ssh/client.py` around line 72:

```python
res['user'] = b'SSHSIG' # logging statements in client.py expect this to be there and raise without it
res['key_type'] = res['hashalg'] # logging statements in client.py expect this to be there and raise without it

```

…and SSH signing now works for me.

Once the next version of lib-agent after v1.0.5 is released this patch no longer be necessary.

---

<div class="post-metadata">

**Author:** ![Ian](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@Ian](https://onlykey.discourse.group/u/Ian)\
**Post date:** [July 28, 2023, 3:56pm UTC](https://onlykey.discourse.group/t/git-commit-signing-with-onlykey-agent/1114/3 "2023-07-28T15:56:44Z")

</div>

lib-agent v1.0.6 was just released and contains the fix: [Release v1.0.6 · onlykey/lib-agent](https://github.com/onlykey/lib-agent/releases/tag/v1.0.6)