FIDO SSH Commit Signatures on GitHub: A Developer Productivity Challenge

In the evolving landscape of developer tools and security, integrating advanced authentication methods like FIDO-backed SSH keys for commit signing is a significant step forward. However, as one GitHub user, FixeQD, recently discovered, the journey isn't always smooth. Their experience highlights a perplexing issue where GitHub's commit verification system fails to recognize valid FIDO SSH signatures, returning a cryptic no_user error, despite all local checks passing. This scenario directly impacts software development productivity metrics by creating friction and uncertainty in the development workflow.

The FIDO SSH Verification Conundrum

FixeQD's setup is robust: they're using a FIDO resident SSH key (specifically sk-ssh-ed25519@openssh.com) to sign their Git commits. Locally, everything works as expected; git verify-commit HEAD confirms a "Good" signature. Yet, when these commits are pushed to GitHub, the platform reports verified: false with the reason no_user. This isn't just an inconvenience; it raises questions about the integrity of commit history and can lead to unnecessary troubleshooting, directly affecting team efficiency and potentially skewing engineering statistics examples related to code security compliance.

What FixeQD Checked (and You Should Too)

Before raising the alarm, FixeQD diligently checked all the usual suspects:

• The committer email is verified, primary, and private on their GitHub account.
• The public FIDO SSH key is correctly registered on the same GitHub account as a Signing Key.
• The key fingerprint matches perfectly.
• Local signature verification succeeds without issue.
• The problem persists across both older and newly created commits.

Environment Details:

• Git: 2.56.0
• OpenSSH: 10.6p1
• Signing format: SSH (gpg.format = ssh)
• Commit signing enabled: commit.gpgsign = true

The registered signing key is of type sk-ssh-ed25519@openssh.com with a fingerprint like SHA256:PQ7KjDqdhO4I+4m6p3pVIcAud9TbxTxmWMqm/+tOv5Y. The public key provided was:

sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHecfiwMw9k6bICGFQ5nEbGbQsOPPVtpjHeEc/7W3kVPAAAAD3NzaDpnaXQtc2lnbmluZw==

GitHub's API response clearly indicates the failure:

{
  "verified": false,
  "reason": "no_user",
  "verified_at": null
}

Contrast this with the successful local verification:

git -c gpg.ssh.allowedSignersFile= verify-commit HEAD

Good "git" signature for with ED25519-SK key SHA256:PQ7KjDqdhO4I+4m6p3pVIcAud9TbxTxmWMqm/+tOv5Y

The Underlying Question: FIDO SSH Support on GitHub

FixeQD's core question, and one pertinent to many developers embracing modern security, is whether GitHub fully supports sk-ssh-ed25519@openssh.com for commit verification. The ability to register the key suggests partial support, but the verification failure indicates a gap. A clearer error message or explicit documentation regarding supported key types would significantly enhance the developer experience and contribute positively to an engineering dashboard by reducing "unverified commit" flags that aren't truly unverified.

This discussion underscores the need for robust platform support for emerging security standards. When advanced features like FIDO SSH keys are adopted, developers expect seamless integration. Issues like this, where valid signatures are rejected, can erode trust in the verification system and hinder the adoption of stronger security practices, ultimately impacting overall software development productivity metrics. Clear communication from platform providers about supported features and better diagnostic messages are essential for maintaining high developer productivity and confidence in security tools.