Cannot sign commits (using ssh)

[ewjoachim]

• Probably has ties to Unable to make a signed (gpg) commit with 2.47.1 #2225
• Split from github.com/Crash on startup depending on launch method #2536

My git config (relevant parts):

[user]
	name = Joachim Jablon
	email = ewjoachim@gmail.com
	signingkey = /Users/joachim/.ssh/id_ecdsa.pub
[commit]
	gpgsign = true
[gpg]
	format = ssh
[gpg "ssh"]
	allowedSignersFile = /Users/joachim/.ssh/allowed_signers

cat /Users/joachim/.ssh/allowed_signers
ewjoachim@gmail.com namespaces="git" ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBMzsjl38DRX1YvgEMHG/AYEPwS/dRR1qhsX+C6f4gFqZD2ZfU9wDHCb5MrzlkMrhRqdVD2e7419J2Z0iRaBhONO/pNq/i0dL2tRh2xMVA5sodj8WBLAIMxBAl6YCBcIINw== PIV AUTH pubkey

cat /Users/joachim/.ssh/id_ecdsa.pub
ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBMzsjl38DRX1YvgEMHG/AYEPwS/dRR1qhsX+C6f4gFqZD2ZfU9wDHCb5MrzlkMrhRqdVD2e7419J2Z0iRaBhONO/pNq/i0dL2tRh2xMVA5sodj8WBLAIMxBAl6YCBcIINw== PIV AUTH pubkey

My SSH key is on a yubikey plugged in a usb port, and I'm using yubikey-agent.

Before the latest version, it worked when I opened fork with open -a fork but it never worked when I opened Fork from the icon.

I've tried "Parent process + brew", "Parent process" and "System shell", same results for the 3.

Complete failure log: (click to open)

23:51:54.664261 git.c:476               trace: built-in: git commit --file=/var/folders/l1/tbjrm3wn7yv5v592h_qk8t300000gn/T/73CDF149-626D-4039-8B77-D9C350178DEE
23:51:54.667248 read-cache.c:2360       performance: 0.000074000 s:  read cache .git/index
23:51:54.667643 read-cache.c:1600       performance: 0.000143000 s:  refresh index
23:51:54.668177 cache-tree.c:497        performance: 0.000269000 s:  cache_tree_update
23:51:54.668425 read-cache.c:3084       performance: 0.000214000 s:  write index, changed mask = 20
23:51:54.668850 run-command.c:1541      run_processes_parallel: preparing to run up to 1 tasks
23:51:54.668870 run-command.c:673       trace: run_command: GIT_EDITOR=: GIT_INDEX_FILE=.git/index .git/hooks/pre-commit
23:51:54.668877 run-command.c:765       trace: start_command: .git/hooks/pre-commit
check for case conflicts.................................................Passed
pretty format json...................................(no files to check)Skipped
check json...........................................(no files to check)Skipped
check toml...........................................(no files to check)Skipped
check yaml...............................................................Passed
check that executables have shebangs.................(no files to check)Skipped
check that scripts with shebangs are executable..........................Passed
check for merge conflicts................................................Passed
check for added large files..............................................Passed
check python ast.....................................(no files to check)Skipped
debug statements (python)............................(no files to check)Skipped
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
mixed line ending........................................................Passed
ruff (legacy alias)..................................(no files to check)Skipped
ruff format..........................................(no files to check)Skipped
Sync repos with uv...................................(no files to check)Skipped
uv-lock..............................................(no files to check)Skipped
23:51:54.929209 run-command.c:1568      run_processes_parallel: done
23:51:54.929928 unpack-trees.c:2012     performance: 0.000062000 s:    traverse_trees
23:51:54.929935 unpack-trees.c:2109     performance: 0.000124000 s:   unpack_trees
23:51:54.929941 diff-lib.c:644          performance: 0.000177000 s:  diff-index
23:51:54.930006 read-cache.c:2360       performance: 0.000021000 s:  read cache .git/index
23:51:54.930019 cache-tree.c:497        performance: 0.000008000 s:  cache_tree_update
23:51:54.930194 run-command.c:673       trace: run_command: ssh-keygen -Y sign -n git -f /Users/joachim/.ssh/id_ecdsa.pub /var/folders/l1/tbjrm3wn7yv5v592h_qk8t300000gn/T//.git_signing_buffer_tmpsgyPYF
23:51:54.930764 run-command.c:765       trace: start_command: /usr/bin/ssh-keygen -Y sign -n git -f /Users/joachim/.ssh/id_ecdsa.pub /var/folders/l1/tbjrm3wn7yv5v592h_qk8t300000gn/T//.git_signing_buffer_tmpsgyPYF
error: No private key found for public key "/Users/joachim/.ssh/id_ecdsa.pub"?

fatal: failed to write commit object
23:51:54.938246 trace.c:416             performance: 0.274481000 s: git command: /Applications/Fork.app/Contents/Resources/git-instance/bin/git commit --file=/var/folders/l1/tbjrm3wn7yv5v592h_qk8t300000gn/T/73CDF149-626D-4039-8B77-D9C350178DEE

I imagine the problem is that fork wouldn't find the env var SSH_AUTH_SOCK=/opt/homebrew/var/run/yubikey-agent.sock, but I don't know how to pass it.

(without fork, it works seamlessly)

[ewjoachim]

The ssh-keygen command in the log works normally in a terminal:

$ echo "yay" > yay
$ ssh-keygen -Y sign -n git -f /Users/joachim/.ssh/id_ecdsa.pub yay
Signing file yay
Write signature to yay.sig

$ ls yay.sig
yay.sig

$ cat yay.sig
-----BEGIN SSH SIGNATURE-----
U1NIU0lHAAAAAQAAAIgAAAATZWNkc2Etc2hhMi1uaXN0cDM4NAAAAAhuaXN0cDM4NAAAAG
EEzOyOXfwNFfVi+AQwcb8BgQ/BL91FHWqGxf4Lp/iAWpkPZl9T3AMcJvkyvOWQyuFGp1UP
Z7vjX0nZnSJFoGE407+k2r+LR0va1GHbExUDmyh2PxYEsAgzEECXpgIFwgg3AAAAA2dpdA
AAAAAAAAAGc2hhNTEyAAAAhAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAaQAAADEAvVKo
5kLYQrKkyWCsN9ajbd+NvhOxzqAY1qPaMB/dDU7DAQCG84aRw8u/DEbSP7tiAAAAMA0aFl
jw/SK3B8nA94IDeAGllgoT7FFQm6Jh0SfLbl+2BgsrhUqTQHNJF9s9mm4YRg==
-----END SSH SIGNATURE-----

[ewjoachim]

Ok, I have a workaround with:

.gitconfig (excerpt)

[gpg "ssh"]
	program = ssh-keygen-with-envvar

~/.local/bin/ssh-keygen-with-envvar:

#!/bin/bash

export SSH_AUTH_SOCK=/opt/homebrew/var/run/yubikey-agent.sock

exec ssh-keygen "$@"

It's enough for me, but you may still want to solve this.

[DanPristupov]

Try to open Fork -> Preferences -> Git and switch Env mode to 'System shell`.