git: Consolidate signing UX for Commit and Tag objects, and introduce auto-sign via new plugin package by pjbgf · Pull Request #1860 · go-git/go-git

pjbgf · 2026-02-18T17:41:09Z

Summary

These changes align the user experience, so that both Tags and Commits
share the same API.

Users can now define a signer at application-level, via new plugin package,
to auto-sign objects when tag.gpgSign=true or commit.gpgSign=true, better
aligning with Git behaviour.

Signers will be implemented as an ObjectSigner plugin out-of-tree. The go-git
project will host some options (e.g. ssh, gpg and auto) in github.com/go-git/x,
but users are recommended to implement their own signers whenever their use-case
requires it.

New `plugin` package

A new plugin package was introduced to provide a generic, thread-safe
registry for plugin factory functions. It enables off-tree implementations
to be registered and retrieved at runtime.

The plugin-based approach comes with two additional benefits:

Users can implement their own signers in line with their needs, without
needing to make changes to the core go-git codebase.
External dependencies brought by such implementations won't be forced on
go-git users that do not require those features. This is temporarily not
true for signature verifiers, but that will change in the near future.

Existing registration mechanisms (e.g. hash.RegisterHash) will be reviewed and
potentially replaced by the new plugin package.

New signing API UX

Here are a few examples of what using the new API should look like.

Signing all tags and commits via `ObjectSigner` plugin

import (
	"github.com/go-git/go-git/v6/x/plugin"
	"github.com/go-git/x/plugin/objectsigner/ssh"
	// "github.com/go-git/x/plugin/objectsigner/gpg"
)

func main() {
	key, _ := getKeyFromAgent() // key can be source from memory, file, etc.

	plugin.Register(plugin.ObjectSigner(),
			func() plugin.Signer { 
				// return gpg.FromKey(key)
				return ssh.FromKey(key, ssh.SHA512)
			})
	
	...

	commit, err := w.Commit("example go-git commit", &git.CommitOptions{
		Author: &object.Signature{
			Name:  "John Doe",
			Email: "john@doe.org",
			When:  time.Now(),
		},
	})
}

Signing single commit using `objectsigner/{ssh,gpg}` package

import (
	"github.com/go-git/x/plugin/objectsigner/ssh"
	// "github.com/go-git/x/plugin/objectsigner/gpg"
)

func main() {
	key, _ := getKeyFromAgent() // key can be source from memory, file, etc.
	commit, err := w.Commit("example go-git commit", &git.CommitOptions{
		// Signer: gpg.FromKey(key)
		Signer: ssh.FromKey(key, ssh.SHA512),

		Author: &object.Signature{
			Name:  "John Doe",
			Email: "john@doe.org",
			When:  time.Now(),
		},
	})
}

Signing single tag using `objectsigner/{ssh,gpg}` package

import (
	"github.com/go-git/x/plugin/objectsigner/ssh"
	// "github.com/go-git/x/plugin/objectsigner/gpg"
)

func main() {
	key, _ := getKeyFromAgent() // key can be source from memory, file, etc.

	_, err = r.CreateTag("foobar", h.Hash(), &CreateTagOptions{
		// Signer: gpg.FromKey(key)
		Signer: ssh.FromKey(key, ssh.SHA512),

		Tagger:  defaultSignature(),
		Message: "foo bar baz qux",
	})
}

Relates to #1849.
Follow-up from #1847.
Supersedes: #1828.

⚠️ This is a breaking change as now System and Global configs are loaded from the ConfigLoader plugin as opposed to directly from disk/env - and by default both return empty configs. This provides greater control for applications that don't want to be exposed to side effects from environmental configuration. A follow-up PR will introduce an opt-in way to align with upstream Git by introducing additional ConfigLoader implementations.

cedric-appdirect

I had some time to look at this PR and I see the benefit for having this plugins out-of-tree. I think we would need to add the Verifier API with trust level as I did in my draft PR to complete the design. I can work on that as a follow up to this PR if you don't have time.

I don't see any issue in using this API to degin signing or even verifying plugins once the API is added following the same principle.

pjbgf · 2026-02-27T11:13:57Z

@cedric-appdirect thanks for the review. I've created an issue to track the verification part of this feature. Feel free to start a discussion there in case you want to pick that issue up.

Copilot

Pull request overview

This PR introduces a new x/plugin registry to enable application-level registration of an object signer and updates commit/tag creation to optionally auto-sign objects when commit.gpgSign=true or tag.gpgSign=true, aligning commit/tag signing UX and behavior more closely with Git.

Changes:

Add a generic, thread-safe plugin registry (x/plugin) and define an ObjectSigner plugin key.
Update commit and tag creation to select a signer from explicit options first, then fall back to the ObjectSigner plugin when config enables auto-signing.
Extend config support/tests for commit.gpgSign, tag.gpgSign, gpg.format, gpg "ssh".allowedSignersFile, and user.signingKey.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
x/plugin/plugin.go	Implements the plugin registry core (register/get/freeze) and test-reset hook.
x/plugin/plugin_signer.go	Defines the `ObjectSigner` plugin key and plugin-level `Signer` interface.
x/plugin/plugin_test.go	Adds registry behavior tests (freeze, overwrite, concurrency, etc.).
worktree_commit.go	Adds commit auto-sign selection logic using config + `ObjectSigner` plugin.
worktree_commit_test.go	Replaces PGP signing tests with signer-selection tests using a mock signer + linkname reset.
repository.go	Adds tag auto-sign selection logic and updates tag signing to use `Signer` instead of PGP key.
repository_test.go	Replaces PGP tag signing tests with signer-selection tests using the mock signer + linkname reset.
options.go	Replaces `CreateTagOptions.SignKey` with `CreateTagOptions.Signer`.
config/config.go	Adds config fields and marshal/unmarshal support for signing-related keys.
config/config_test.go	Adds tests for new config keys and round-trip behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

x/plugin/plugin.go

x/plugin/plugin_test.go

repository.go

config/config.go

x/plugin/plugin.go

worktree_commit.go

config/config.go

x/plugin/plugin.go

Signed-off-by: Paulo Gomes <pjbgf@linux.com>

The plugin package provides a generic, thread-safe registry for plugin factory functions. It enables off-tree implementations to be registered and retrieved at runtime. The first plugin type introduced is ObjectSigner. When registered, the plugin will define a function factory which will be used when creating commits or tags. Signed-off-by: Paulo Gomes <pjbgf@linux.com>

When no CommitOptions.Signer is provided, buildCommitObject falls back to the globally registered ObjectSigner plugin. An explicit CommitOptions.Signer always takes precedence over the plugin. Signed-off-by: Paulo Gomes <pjbgf@linux.com>

These changes align the user experience, so that both Tags and Commits share the same API. The implementation details are now pushed back into the out-of-tree plugins, removing external dependencies from the core go-git logic. Signed-off-by: Paulo Gomes <pjbgf@linux.com>

Add support for GPG configuration in git config, following existing patterns for User, Author, and Committer sections. New configuration options: - gpg.format: signature format ("openpgp" or "ssh") - gpg.ssh.allowedSignersFile: path to SSH allowed signers file This enables reading Git's gpg.ssh.allowedSignersFile setting for SSH signature verification workflows.

Expand on sections/keys exposed by config.Config so that go-git can implement heuristics to automatically GPG/SSH sign objects. Added fields: tag.gpgSign, commit.gpgSign and user.signingKey. Signed-off-by: Paulo Gomes <pjbgf@linux.com>

Auto-signing objects now respect the config values for tag.gpgSign and commit.gpgSign, meaning that when an ObjectSigner is registered, it will only be used when either setting is enabled. Signed-off-by: Paulo Gomes <pjbgf@linux.com>

Signed-off-by: Paulo Gomes <pjbgf@linux.com>

Signed-off-by: Paulo Gomes <paulo@entire.io>

Plain bool fields are indistinguishable from "not set" when their value is false, because config.Merge skips zero-valued fields. This prevented a lower-scope tag.gpgSign=false (or commit.gpgSign=false) from overriding a higher-scope true, which broke Git's "last scope wins" semantics and could force unexpected auto-signing. Replace the bool fields with OptBool, a tri-state type whose zero value (OptBoolUnset) is correctly skipped by Merge, while OptBoolFalse (1) is non-zero and propagates through the merge chain. Also fix stale error message strings in tests left over by the go fix pass, and make tests resilient to host-level commit.gpgSign settings. Signed-off-by: Paulo Gomes <paulo@entire.io> Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Paulo Gomes <paulo@entire.io>

Add a ConfigSource plugin interface with a single Load(scope) method that returns a config.ConfigStorer for the requested scope (global or system). This decouples config loading from the host filesystem, allowing implementations backed by environment variables, in-memory data, or remote sources. Key changes: - x/plugin: Define ConfigSource interface and ConfigLoader plugin key - x/plugin/config: Add Empty, Static, and readOnlyStorer implementations - repository: ConfigScoped uses the registered ConfigSource plugin, falling back to NewEmpty when none is registered - config: Deprecate LoadConfig in favour of the new Load function - tests: Register a default static ConfigSource in TestMain so all tests are isolated from host git configuration Signed-off-by: Paulo Gomes <paulo@entire.io> Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

x/plugin/config/static.go

repository.go

x/plugin/config/static.go

cloneConfig: deep-copy slice fields in RemoteConfig (URLs, Fetch) and URL (InsteadOfs) so in-place mutations do not leak across copies. Guard against nil map values that would panic on dereference. Fully deep-copy Raw (format/config.Config) including sections, subsections, options, and includes instead of a shallow struct copy. ConfigScoped: load and return the local config without requiring a ConfigLoader plugin when scope is LocalScope, aligning with the ConfigSource contract that Load is never called with LocalScope. Signed-off-by: Paulo Gomes <paulo@entire.io> Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>

cedric-appdirect

Let's go!

pjbgf force-pushed the sign-plugin branch from ba7d535 to a515f83 Compare February 20, 2026 15:50

pjbgf mentioned this pull request Feb 22, 2026

Add information about x/plugin go-git/docs#4

Open

cedric-appdirect approved these changes Feb 27, 2026

View reviewed changes

pjbgf force-pushed the sign-plugin branch from a515f83 to 928f094 Compare February 27, 2026 11:28

pjbgf marked this pull request as ready for review February 27, 2026 23:24

pjbgf requested review from Copilot and hiddeco February 27, 2026 23:24

Copilot AI reviewed Feb 27, 2026

View reviewed changes

Bluebugs mentioned this pull request Mar 1, 2026

Improve UX for verifying commits and Tags #1869

Open

2 tasks

bb-Ricardo mentioned this pull request Mar 3, 2026

GPG/SSH signature improvement #1828

Draft

pjbgf mentioned this pull request Mar 4, 2026

Commits don't respect commit.gpgsign git config (unsigned commits) entireio/cli#311

Open

Bluebugs mentioned this pull request Mar 6, 2026

Verify plugin #1883

Draft

pjbgf force-pushed the sign-plugin branch from 928f094 to e109af6 Compare March 20, 2026 17:05

pjbgf commented Mar 20, 2026

View reviewed changes

x/plugin/plugin.go Show resolved Hide resolved

pjbgf force-pushed the sign-plugin branch from e109af6 to 66eb03b Compare March 23, 2026 15:49

pjbgf and others added 12 commits March 24, 2026 07:15

git: Remove gpgSigner from worktree

70042d7

Signed-off-by: Paulo Gomes <pjbgf@linux.com>

git: auto-sign commits via ObjectSigner plugin

c5699b5

When no CommitOptions.Signer is provided, buildCommitObject falls back to the globally registered ObjectSigner plugin. An explicit CommitOptions.Signer always takes precedence over the plugin. Signed-off-by: Paulo Gomes <pjbgf@linux.com>

build: Fix linter violations

aa072d7

Signed-off-by: Paulo Gomes <pjbgf@linux.com>

docs: Update EXTENDING.md with plugin information

5c32c2b

Signed-off-by: Paulo Gomes <paulo@entire.io>

*: Apply go fix ./...

13db23d

Signed-off-by: Paulo Gomes <paulo@entire.io>

git: Fetch errors if RemoteConfig is nil

39debcc

Signed-off-by: Paulo Gomes <paulo@entire.io>

pjbgf force-pushed the sign-plugin branch from 66eb03b to ee2814d Compare March 24, 2026 07:16

pjbgf added the breaking label Mar 24, 2026

pjbgf force-pushed the sign-plugin branch from ee2814d to 772c1ee Compare March 24, 2026 08:52

pjbgf requested a review from Copilot March 24, 2026 08:55

Copilot started reviewing on behalf of pjbgf March 24, 2026 08:55 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

x/plugin/config/static.go Outdated Show resolved Hide resolved

repository.go Show resolved Hide resolved

x/plugin/config/static.go Outdated Show resolved Hide resolved

pjbgf requested a review from cedric-appdirect March 24, 2026 15:13

cedric-appdirect approved these changes Mar 24, 2026

View reviewed changes

pjbgf merged commit cd85c8c into go-git:main Mar 24, 2026
16 checks passed

pjbgf deleted the sign-plugin branch March 24, 2026 22:13

pjbgf mentioned this pull request Mar 25, 2026

Implement ConfigLoader plugins that aligns with upstream behaviour #1924

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

git: Consolidate signing UX for Commit and Tag objects, and introduce auto-sign via new plugin package#1860

git: Consolidate signing UX for Commit and Tag objects, and introduce auto-sign via new plugin package#1860
pjbgf merged 14 commits intogo-git:mainfrom
pjbgf:sign-plugin

pjbgf commented Feb 18, 2026 •

edited

Loading

Uh oh!

cedric-appdirect left a comment

Uh oh!

pjbgf commented Feb 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cedric-appdirect left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

pjbgf commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

New plugin package

New signing API UX

Signing all tags and commits via ObjectSigner plugin

Signing single commit using objectsigner/{ssh,gpg} package

Signing single tag using objectsigner/{ssh,gpg} package

Uh oh!

cedric-appdirect left a comment

Choose a reason for hiding this comment

Uh oh!

pjbgf commented Feb 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cedric-appdirect left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

pjbgf commented Feb 18, 2026 •

edited

Loading

New `plugin` package

Signing all tags and commits via `ObjectSigner` plugin

Signing single commit using `objectsigner/{ssh,gpg}` package

Signing single tag using `objectsigner/{ssh,gpg}` package