From 80fcac254297fb2ac4f6e57bb6f2c6847e5fc327 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 24 Aug 2026 12:43:44 -0700 Subject: [PATCH 1/2] Fix ssh-signing.md allowed_signers Snippet to Match host-setup.md (#974) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Applies the same fix PR #708 made in `docs/host-setup.md` to `docs/ssh-signing.md`, which carried the identical bugs: 1. Missing `--global` on `git config user.email`, which silently writes the wrong principal into `allowed_signers` when run from inside an existing repo checkout with a local override. 2. A backslash line-continuation across two lines, collapsed into one, matching the fixed shape in `docs/host-setup.md`. Also fixes the identical inline reference to the same snippet in the Troubleshooting section. Fixes #713 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- docs/ssh-signing.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docs/ssh-signing.md b/docs/ssh-signing.md index 3c314c2b..9fcde27c 100644 --- a/docs/ssh-signing.md +++ b/docs/ssh-signing.md @@ -32,8 +32,7 @@ Build it from your existing public key: ```shell mkdir -p ~/.config/git -echo "$(git config user.email) namespaces=\"git\" $(cat ~/.ssh/id_ed25519.pub)" \ - >> ~/.config/git/allowed_signers +echo "$(git config --global user.email) namespaces=\"git\" $(cat ~/.ssh/id_ed25519.pub)" >> ~/.config/git/allowed_signers ``` If you collaborate with others, append their entries to the same file, where each line maps an email to a public key. @@ -115,7 +114,7 @@ If the container's `~/.ssh` directory exists with the wrong owner (root, surface **`gpg.ssh.allowedSignersFile needs to be configured`.** Set `git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers` and ensure the file exists. -**`signing failed: no allowed signers`.** The `allowed_signers` file exists but doesn't contain a line matching `user.email` + a key. Re-run the `echo $(git config user.email) namespaces="git" $(cat ~/.ssh/id_ed25519.pub) >> ...` snippet. +**`signing failed: no allowed signers`.** The `allowed_signers` file exists but doesn't contain a line matching `user.email` + a key. Re-run the `echo $(git config --global user.email) namespaces="git" $(cat ~/.ssh/id_ed25519.pub) >> ...` snippet. **Verifies on the host but not in the container.** The bind-mount source path differs. `${localEnv:HOME}` resolves on Linux/macOS hosts, and on Windows hosts (WSL2 backend) the `${localEnv:USERPROFILE}` fallback in `devcontainer.json` handles it. Check the actual mount with `mount | grep ssh` inside the container. From 04a1e3d7c83168bf25b4b8f452e00d85644ecb65 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 24 Aug 2026 13:16:59 -0700 Subject: [PATCH 2/2] Fix Broken Troubleshooting Snippet in ssh-signing.md (#976) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #975 (the develop -> main promotion PR) surfaced this against #974's change: the "signing failed: no allowed signers" troubleshooting line paraphrased the setup snippet as an unquoted, truncated `echo ... >> ...` form. Copied literally, a shell strips the quotes around `"git"` (writing `namespaces=git` instead of `namespaces="git"`), and the truncated destination path isn't a real command. Both CodeRabbit and Qodo flagged this independently on PR #975. Fix: use the exact, complete command from the setup section (matching line 35) instead of paraphrasing it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by CodeRabbit - **Documentation** - Corrected the SSH signing troubleshooting command to use proper quoting and the complete allowed signers file path. --- docs/ssh-signing.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/ssh-signing.md b/docs/ssh-signing.md index 9fcde27c..2d9024d2 100644 --- a/docs/ssh-signing.md +++ b/docs/ssh-signing.md @@ -114,7 +114,7 @@ If the container's `~/.ssh` directory exists with the wrong owner (root, surface **`gpg.ssh.allowedSignersFile needs to be configured`.** Set `git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers` and ensure the file exists. -**`signing failed: no allowed signers`.** The `allowed_signers` file exists but doesn't contain a line matching `user.email` + a key. Re-run the `echo $(git config --global user.email) namespaces="git" $(cat ~/.ssh/id_ed25519.pub) >> ...` snippet. +**`signing failed: no allowed signers`.** The `allowed_signers` file exists but doesn't contain a line matching `user.email` + a key. Re-run `echo "$(git config --global user.email) namespaces=\"git\" $(cat ~/.ssh/id_ed25519.pub)" >> ~/.config/git/allowed_signers`. **Verifies on the host but not in the container.** The bind-mount source path differs. `${localEnv:HOME}` resolves on Linux/macOS hosts, and on Windows hosts (WSL2 backend) the `${localEnv:USERPROFILE}` fallback in `devcontainer.json` handles it. Check the actual mount with `mount | grep ssh` inside the container.