We're considering to have op-ssh-sign check for SSH_TTY / SSH_CONNECTION and SSH_AUTH_SOCK, and if both are set, use SSH_AUTH_SOCK instead. That should remove the need for these SSH config and rc file snippets.

We'll keep this thread posted if we have any updates on this.

I got this working using @malo solution but it doesn't work when trying to use SSH signing with 1Password.

My workaround right now is to manually remove gpg.ssh.program from .gitconfig when connecting to the remote over SSH and then adding it again when using the remote computer in person.

Hi @datwaft:

If you're looking to use 1Password SSH agent commit signing on a device when accessed locally as well as remotely, your best bet is to ensure that $SSH_AUTH_SOCK is set to your forwarded agent socket when SSH'd into that device, and then the 1Password SSH agent socket when you're using it in person.

SSH signing by default uses the agent pointed to by $SSH_AUTH_SOCK. and setting op-ssh-sign as the SSH program overrides that function.

Jack

I saw that in the documentation and tried to do something like that but it didn't work for me.
I just tried once again and it seems to work, I probably had the wrong socket set to SSH_AUTH_SOCK.

Quick question, is ~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock always the path to the 1Password agent socket or it can change in the future? I want to see if I should hardcode it in my dotfiles with a condition like test -z $SSH_TTY.

Hi @datwaft:

Great question. While it's possible that the path to the agent may change in the future, there aren't any plans or intent to change it.

Additionally, that path will be the same on every macOS install, and won't vary based on the specific Mac computer it's installed on.

Jack

Here's a simple redirect script that I use as my gpg.ssh.program setting in gitconfig. It's based on @floris_1P's comment above and can be used as a placeholder until op-ssh-sign supports this natively:

git-ssh-sign
```

!/bin/bash

if [[ "$SSH_CONNECTION" ]] && [[ "$SSH_AUTH_SOCK" ]]; then
ssh-keygen "$@"
else
/Applications/1Password.app/Contents/MacOS/op-ssh-sign "$@"
fi
```

In gitconfig:


[gpg "ssh"]
program = /path/to/git-ssh-sign


Thanks for sharing @jgoz!

Jack

We're considering to have op-ssh-sign check for SSH_TTY / SSH_CONNECTION and SSH_AUTH_SOCK, and if both are set, use SSH_AUTH_SOCK instead. That should remove the need for these SSH config and rc file snippets.

Just wanted to follow up here that this has now been implemented!

good news
starting which version ?

Starting with version 8.10.4.