Support ssh-agent and external sign binaries for commit signing with ssh

[chirpcel]

This Pull Request fixes/closes #2188.

It changes the following:

• Respect configuration for alternative signing binary (for example 1Password ssh agent)
• Using ssh-keygen for ssh signing operation to support ssh-agent
  • additional: sharing same implementation for default & configured binary

I followed the checklist:

• I added unittests
• I ran make check without errors
• I tested the overall application
• I added an appropriate item to the changelog

[chirpcel]

There's one drawback. Like before, we don't support encrypted private keys which are not loaded to agent. The error message isn't as clear as before, but from a functionality point of view it isn't different. I would make a new issue for this behavior and take a look into supporting encrypted private keys.

[extrawurst]

The error message isn't as clear as before

cant we make it as clear as before and then followup

supporting encrypted private keys.

[chirpcel]

Actually I didn't figured out how to capture the passphrase prompt, as it's spawned directly on the tty.
But I just have an Idea, maybe we could provide an empty passphrase as arg to skip the password prompt and map the "wrong passphrase" error to the previous error message.
I'll take a look at it today.

[chirpcel]

@extrawurst Worked, we now have a meaningful error message. I tested with 1Password SSH-Agent, Default SSH-Agent, non encrypted keys on disk and encrypted keys on disk.

[DaRacci]

Any movement on this?

This would allow me to use gitui without needing to fallback to shell to actually commit.

[chirpcel]

@DaRacci Think maintainer is currently busy as asking for co-maintainers and migrating his repo to an org for better support by more people.
For now you can compile yourself with applied pr as I do or wait.

[naseschwarz]

Hey @chirpcel. Thank you for this implementation. I support this fully and agree that this should be the way commit signing is implemented at the moment. It is almost in compliance with git commit's implementation. Where changes will be required for currently unsupported git commit signing features, I have remarked them in this review. I wouldn't say that these are blockers, though.

I also have minor questions and nitpicks, mostly about corner cases, here and there and some FYIs.

On which platforms have you tested this? I have tested it on Linux and it works as promised. It would be great if someone tested this on Windows and Mac, too, though. (A test should consist of at least signing a commit and checking whether that commit's signature can be validated.)

[chirpcel]

Thanks @naseschwarz for your cr! I commited your suggestions and commented on questions. I'll take a look at the remaining annotations of edge cases/optimizations. I'll update the pr soon.

I've tested the implementation on linux and macOS. Windows currently missing, maybe I can test it in a VM. Currently don't know about license/activation. Keep you updated.

[hazzuk]

Would simply like to add that I've been been running a compiled version of gitui with this pull request since August. So far I've had no issues on my Linux setup.

For me, ssh-agent support was critical, so I'd also like to say thank you for this work. I hope we see this merged one day.

[chirpcel]

@hazzuk Me too and I totally forgot that I have this PR open 😶‍🌫️
You just bring back my attention to it. I'll sort out the last open notes and the we should get it merged.

[chirpcel]

Open notes should now been solved.
I'll test tomorrow on some machines with different configs and then request an follow-up review.

[chirpcel]

I didn't encounter problems on my machines. Tested on linux with openssh agent and pgp based ssh agent.

[asgeirn]

Tested on MacOS using 1Password signing, worked perfectly!

[chirpcel]

@extrawurst
As this initial PR is some months old and it happened much since them, who is currently able to do a review on changes?

[cruessler]

I’ll have a look!

[cruessler]

(Just wanted to let you know that I haven’t forgotten this PR. I hope to be getting to it over the weekend.)

[cruessler]

First of all, sorry for the long delay! (I wanted to make sure I had the time and focus needed for an actual review, and that took some time, unfortunately.)

Overall, this looks good to me, as far as I can tell. I just have a few questions.

[SergioRibera]

Any movement on this? 👀

[asgeirn]

With some help from Claude I've rebased this branch on the latest master, it's at https://github.com/asgeirn/gitui/tree/feature/external-ssh-signer for those who want to try it.

[extrawurst]

@asgeirn are you interested in driving this PR over the finish line? i adopted it. could use some folks actually using ssh-agent based signing to give it another go and test

[extrawurst]

@cruessler I adopted this PR and cleaned up the remaining nits. can you give it a last test run 🙏

[asgeirn]

Tested it with my setup (1password agent commit signing) and it works.

warning: gitui@0.28.1: buildname '0.28.1-nightly 2026-07-01 (ca34d08)'