gpg-ssh signing with AgentForwarding

>Hello Git community,
>Not sure what search terms I haven't used, but I'll try to describe the use-case
>
>On my local machine I have a SSH key, and I use AgentForwarding when I
>go out and about to other hosts (dev machines)
>The usual workflow of using the forwarded socket works for pull and push.
>
>Where it gets pitch-dark is when I try to use my ssh key to sign git commits.
>Following is my git config on the remote host:

>=====================
>[user]
>    name = John Doe
>    email = jdoe@jdoe.com
># on my local machine(gpg-ssh signing works): signingkey =
>/Users/jdoe/.ssh/id_ecdsa.pub
>    signingkey = WHAT_SHOULD_I_PUT_HERE # on my laptop its the path to
>the public key from Secretive, or just omit it?

>[gpg]
>    format = ssh
>[commit]
>    gpgsign = true
>[gpg "ssh"]
>    allowedSignersFile = /Users/jdoe/.gpg.ssh.allowedSignersFile #
>contents is: "email1,email2 key-type public_key comment"
>=====================
>
>I've tried
>1. `ssh-agent -a /path/to/ssh.sock` - errored with address already in use
>2. signingkey set to a path on the remote host with my public key,
>errored with "no private key found"
>
>I sense that I should be able to employ `gpg.ssh.defaultKeyCommand` to
>use the socket somehow, but I can't wrap my head around it or find
>some docs/guidance.

>
>Other (related) links
>https://developer.1password.com/docs/ssh/git-commit-signing/ - I think
>that 1Password invested the time to make it work
>https://github.com/maxgoedjen/secretive/discussions/338#discussioncomment-11170722
>- asked the same on Secretive repo, which is one way to store keys
>https://github.com/maxgoedjen/secretive/issues/405#issuecomment-2460948732
>- also here.
>
>Thank you,
>Jordan
>

> Hello Git community,
> Not sure what search terms I haven't used, but I'll try to describe the use-case
> 
> On my local machine I have a SSH key, and I use AgentForwarding when I
> go out and about to other hosts (dev machines)
> The usual workflow of using the forwarded socket works for pull and push.
> 
> Where it gets pitch-dark is when I try to use my ssh key to sign git commits.
> Following is my git config on the remote host:
> =====================
> [user]
>     name = John Doe
>     email = jdoe@jdoe.com
> # on my local machine(gpg-ssh signing works): signingkey =
> /Users/jdoe/.ssh/id_ecdsa.pub
>     signingkey = WHAT_SHOULD_I_PUT_HERE # on my laptop its the path to
> the public key from Secretive, or just omit it?

>
> On 2024-11-07 at 04:16:34, Yarden Bar wrote:
> > Hello Git community,
> > Not sure what search terms I haven't used, but I'll try to describe the use-case
> >
> > On my local machine I have a SSH key, and I use AgentForwarding when I
> > go out and about to other hosts (dev machines)
> > The usual workflow of using the forwarded socket works for pull and push.
> >
> > Where it gets pitch-dark is when I try to use my ssh key to sign git commits.
> > Following is my git config on the remote host:
> > =====================
> > [user]
> >     name = John Doe
> >     email = jdoe@jdoe.com
> > # on my local machine(gpg-ssh signing works): signingkey =
> > /Users/jdoe/.ssh/id_ecdsa.pub
> >     signingkey = WHAT_SHOULD_I_PUT_HERE # on my laptop its the path to
> > the public key from Secretive, or just omit it?
>
> I think you want something like this:
>
>   [user]
>       signingkey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"
>
> You should use your own key; that's just an example.  Note that you want
> the public key (that is, what's in `id_ecdsa.pub`, not `id_ecdsa`).
>
> Once you have the key in the config file like that, with the "key::"
> prefix, Git will pull from the agent if necessary.  I do that for
> signing commits using GitHub Codespaces, where it's easier to forward
> an SSH agent to the remote system than with GnuPG.
>
> This is documented in the `user.signingKey` entry in `git config
> --help`, but if there's something there that's unclear or you think the
> text could be improved, please say something, and we'll try to get it
> fixed.
> --
> brian m. carlson (they/them or he/him)
> Toronto, Ontario, CA