Stratify
Engineering

Git Signing

docs/runbooks/git-signing.md

Source updated 03. Aug. 2026

Git commit signing (SSH + Touch ID)

Global config uses SSH format signing (commit.gpgsign true). Commits call ssh-keygen -Y sign, which needs the signing key in ssh-agent (Touch ID once via Keychain).

One-time / after reboot

ssh-add --apple-use-keychain ~/.ssh/id_ed25519_signing
ssh-add -l   # should list the key

Commit (interactive terminal)

git commit -m "your message"
# Touch ID or Keychain prompt expected

Cursor agent / CI

Non-interactive shells cannot show Touch ID. Either:

  • Run ssh-add in your terminal first (same login session may inherit agent), or
  • Commit yourself in the integrated terminal, or
  • git commit --no-gpg-sign on throwaway branches only.

Verify on GitHub

Commits show Verified when the signing public key is added under GitHub → Settings → SSH and GPG keys → Signing keys.