SSH key signing with Windows's ssh-agent

[hrach]

• I was not able to find an open or closed issue matching what I'm seeing

Setup

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?

$ git --version --build-options

git version 2.34.1.windows.1
cpu: x86_64
built from commit: 2ca94ab318509b3c271e82889938816bad76dfea
sizeof-long: 4
sizeof-size_t: 8
shell-path: /bin/sh
feature: fsmonitor--daemon

• Which version of Windows are you running? Vista, 7, 8, 10? Is it 32-bit or 64-bit?

$ cmd.exe /c ver

Microsoft Windows [Version 10.0.22000.434]

• What options did you set as part of the installation? Or did you choose the
  defaults?

# One of the following:
> type "C:\Program Files\Git\etc\install-options.txt"
> type "C:\Program Files (x86)\Git\etc\install-options.txt"
> type "%USERPROFILE%\AppData\Local\Programs\Git\etc\install-options.txt"
$ cat /etc/install-options.txt

Editor Option: VIM
Custom Editor Path:
Default Branch Option:
Path Option: Cmd
SSH Option: OpenSSH
Tortoise Option: false
CURL Option: OpenSSL
CRLF Option: LFOnly
Bash Terminal Option: MinTTY
Git Pull Behavior Option: FFOnly
Use Credential Manager: Enabled
Performance Tweaks FSCache: Enabled
Enable Symlinks: Enabled
Enable Pseudo Console Support: Enabled
Enable FSMonitor: Disabled

• Any other interesting things about your environment that might be related
  to the issue you're seeing?

** insert your response here **

Details

I have exactly the same problem described here.

[commit]
    gpgsign = true
[gpg]
    format = ssh
[user]
    signingkey = ssh-ed25519 mykeyhere
[core]
    sshCommand = C:/Windows/System32/OpenSSH/ssh.exe

• Which terminal/shell are you running Git from? e.g Bash/CMD/PowerShell/other

Bash

• What commands did you run to trigger this issue? If you can provide a
  Minimal, Complete, and Verifiable example
  this will help us understand the issue.

git commit -m "test"

• What did you expect to occur after running these commands?

Successfully signed commit.

• What actually happened instead?

error: Load key "C:\\dev\\msys64\\tmp/.git_signing_key_tmpA2RRLI": invalid format?

fatal: failed to write commit object

[dscho]

ssh-ed25519

This sounds like exactly what gitgitgadget@350a251 is about, which made it into v2.35.0-rc2 (which once again proves just how important it is for the community to test these release candidates). Have you tried that release candidate?

[hrach]

Hi, I don't believe this is a git issue, since there are tutorials mentioning ssh signing with ed25519, namely this or this in Git 2.34. I expect this to be Windows-related issue.

I've tried 2.35.0-rc02 and it does not work.

$ git --version
git version 2.35.0.rc2.windows.1
$ git commit -m "test"
error: Load key "C:\\dev\\msys64\\tmp/.git_signing_key_tmp0vDNQR": invalid format?

fatal: failed to write commit object

[rimrul]

ssh-ed25519

This sounds like exactly what gitgitgadget@350a251 is about

No. That is about key types that don't start with ssh-.

[core] sshCommand = C:/Windows/System32/OpenSSH/ssh.exe

Could you check the version of that ssh.exe?

It should at least be v8.2 for ssh signing. And I think v8.7 also had some issues with segfaults for that use case.

[rimrul]

Oh and GIT_TRACE=1 git commit -m "test" could help us see what exact ssh command failed.

[rimrul]

SSH Option: OpenSSH

[core]
    sshCommand = C:/Windows/System32/OpenSSH/ssh.exe

I think I've found the issue. core.sshCommand only applies to calls to ssh, not ssh-keygen which is needed for ssh signing. So git calls the included msys2 ssh-keygen instead of the system one.

[hrach]

Yeah, something related was mentioned in the link I've included in the original report:
https://superuser.com/questions/1695601/use-ssh-key-signing-with-git-and-ssh-agent-under-windows

[rimrul]

You might be able to get this to work by selecting "Use exterrnal OpenSSH" on the "Choosing the SSH executable" page of the installer. You might have to uncheck "Only show new options" to see that page again.

[hrach]

Thank you a lot!

had to make two changes:

• reinstall Git with the "Use external OpenSSH"
• update Window's OpenSSH (repo, tutorial); without it it showed Unsupported certificate option "verify-time=20220125190555" when browsing commits with git show --show-signature