How to fix error: ssh signing is not configured. Set user.signingkey and gpg.format in Git

First, inspect your current Git signing settings to understand what's configured:

# Check all signing-related configuration
git config --list | grep -E "(gpg|signing)"

# Check specific settings
git config --get gpg.format
git config --get user.signingkey
git config --get commit.gpgsign

Expected output for SSH signing:

gpg.format=ssh
user.signingkey=/home/user/.ssh/id_ed25519.pub
commit.gpgsign=true

If gpg.format shows ssh but user.signingkey is empty or missing, that's your problem.

Configure Git to use SSH for signing instead of GPG:

# Set SSH as the signing format
git config --global gpg.format ssh

This tells Git to use SSH keys for signing rather than GPG keys. The setting name gpg.format is historical - Git originally only supported GPG, so the configuration namespace remained even when SSH support was added.

Point Git to your SSH public key for signing:

# For Ed25519 keys (recommended)
git config --global user.signingkey ~/.ssh/id_ed25519.pub

# For RSA keys
git config --global user.signingkey ~/.ssh/id_rsa.pub

# You can also use the literal public key content
git config --global user.signingkey "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... [email protected]"

Important notes:
- Use the public key file (ending in .pub), not the private key
- Git uses the public key to find the corresponding private key via ssh-agent
- The path can be absolute or relative to your home directory

Verify the key file exists:

ls -la ~/.ssh/id_ed25519.pub
cat ~/.ssh/id_ed25519.pub

If you want all commits to be signed automatically without using the -S flag:

# Sign all commits automatically
git config --global commit.gpgsign true

# Sign all tags automatically
git config --global tag.gpgsign true

With these settings, every git commit and git tag will be signed using your SSH key.

To sign a single commit manually:

git commit -S -m "Your commit message"

SSH signing requires your private key to be loaded in the ssh-agent:

# Start the SSH agent
eval "$(ssh-agent -s)"

# Add your private key
ssh-add ~/.ssh/id_ed25519

# Verify the key is loaded
ssh-add -l

On macOS, persist the key across restarts:

# Add to keychain
ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Create or update ~/.ssh/config for automatic key loading:

Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

Verify that signing works correctly:

# Make a test commit
echo "test" >> test.txt
git add test.txt
git commit -S -m "Test signed commit"

Verify the signature:

# Show commit with signature
git log --show-signature -1

If successful, you'll see output indicating the commit was signed. If you get an error, check that your ssh-agent has the key loaded.

To verify SSH signatures locally, set up an allowed signers file:

# Create the allowed signers file
mkdir -p ~/.config/git
touch ~/.config/git/allowed_signers

# Configure Git to use it
git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers

Add your public key to the allowed signers file:

# Format: email-address key-type public-key
echo "[email protected] $(cat ~/.ssh/id_ed25519.pub)" >> ~/.config/git/allowed_signers

This enables Git to verify signatures from yourself and others whose keys you add to the file.

For commits to show as "Verified" on GitHub or GitLab, add your SSH key as a signing key:

GitHub:
1. Go to https://github.com/settings/keys
2. Click "New SSH key"
3. Select Key type: Signing Key (not Authentication)
4. Paste your public key
5. Click "Add SSH key"

Note: You can use the same SSH key for both authentication and signing, but you must add it twice - once as an Authentication key and once as a Signing key.

GitLab:
1. Go to https://gitlab.com/-/profile/keys
2. Paste your public key
3. Under "Usage type", select "Signing" or "Authentication and signing"
4. Click "Add key"

Bitbucket:
Bitbucket doesn't currently support SSH commit signing verification, but commits will still be signed locally.

If you're still getting errors, there might be conflicting local settings:

# Check for local overrides
git config --local --list | grep -E "(gpg|signing)"

# Remove local signing settings to use global ones
git config --local --unset gpg.format
git config --local --unset user.signingkey
git config --local --unset commit.gpgsign

# Verify global settings apply
git config --get gpg.format
git config --get user.signingkey

If switching from GPG to SSH signing:

# Remove GPG-specific settings
git config --global --unset gpg.program