I think I need to set up my gitconfig and add my GPG key, because all of my commits in the PRs are showing up as unsigned (not verified). In the Environment, under the **Setup script** section, add the following lines one by one: ```bash git config --global user.name " " git config --global user.email " " git config --global user.signingkey " " git config --global commit.gpgsign true git config --global tag.gpgSign true ``` kind of? Just checked, default values are: ```bash

Sign commits

Open 💬 14 comments Opened Jun 8, 2025 by vigo

💡 Likely answer: A maintainer (gpeal, contributor) responded on this thread — see the highlighted reply below.

I think I need to set up my gitconfig and add my GPG key, because all of my commits in the PRs are showing up as unsigned (not verified).

In the Environment, under the Setup script section, add the following lines one by one:

git config --global user.name "<NAME>"
git config --global user.email "<EMAIL>"
git config --global user.signingkey "<KEY>"
git config --global commit.gpgsign true
git config --global tag.gpgSign true

kind of?

Just checked, default values are:

git config user.name
Codex04l
git config user.email
codex@openai.com

Should I overwrite them?

thank you.

View original on GitHub ↗

14 Comments

booleanbetrayal · 1 year ago

We're also interested in retaining commit signing in any repos that Codex plays with. Is there planned support for this + documentation?

mvgijssel · 1 year ago

Jus had a PR fail because the commits coming from Codex are not signed https://github.com/vgijssel/setup/pull/689. Note the PR was created using the Codex UI.

justinoboyle · 11 months ago

Have had to amend the branch manually and re-sign the commits myself a few times — makes quick bugfixes significantly more steps.

Would be great for Codex to respect Git settings for this, or at least be able to point it to a GPG key to use.

vigo · 11 months ago

@justinoboyle yep, i pull the codex' branch and make an empty commit for signing and push...

ETeissonniere · 10 months ago

It sounds like Codex auto disable signing in the local git repo after some error with signing. I believe this might be before of the sandboxing? I had successful signing with Claude Code. I wonder if there is a way to allow Codex to access the required files.

  ✗ ⌨️ git commit -m 'SKIPPED'
    error: gpg failed to sign the data:
    gpg: failed to create temporary file '/home/eliottteissonniere/.gnupg/.#lk0x00005b37a73a6200.rehoboam.59314': Permission denied
    gpg: can't allocate lock for '/home/eliottteissonniere/.gnupg/pubring.kbx'
    gpg: failed to create temporary file '/home/eliottteissonniere/.gnupg/.#lk0x00005b37a73ba3d0.rehoboam.59314': Permission denied
    gpg: can't connect to the gpg-agent: Permission denied
… +2 lines
    [GNUPG:] INV_SGNR 0 DFF888FA7176AD9A
    [GNUPG:] FAILURE sign 33554509
    gpg: signing failed: No agent running
    
    fatal: failed to write commit object
  ✓ ⌨️ git config commit.gpgsign false

gpeal contributor · 10 months ago

If your repo requires signed commits, I recommend using the VS Code extension to apply changes locally, commit, then push it yourself. I realize this isn't ideal but the VS Code/Cursor/Windsurf extension makes it much easier to apply cloud changes locally than it was before.

vigo · 10 months ago

If your repo requires signed commits, I recommend using the VS Code extension to apply changes locally, commit, then push it yourself. I realize this isn't ideal but the VS Code/Cursor/Windsurf extension makes it much easier to apply cloud changes locally than it was before.

:) Well, I'm not using VS Code or editors like that. Sure, I know how to work around it. The question is: Codex can create a branch, write code, and make a commit, but I want Codex to make a signed commit (currently it's not signing).

markoa · 10 months ago

With the introduction of Codex Cloud, I hope the team can prioritize this soon. We'd love to delegate as much work as possible to parallel Codex Cloud tasks, but it's not feasible to use it in any capacity if we have to manually amend every cloud task.

k-thornton · 10 months ago

I also have to pull every codex branch, amend the commit, push it again.

not only is this annoying, but I'm sure it's skewing the Codex "successful PR commits" statistic in the wrong direction, in a way the OpenAI product team would care about.

cc @embirico

ilyvion · 10 months ago

Given that the issue was closed without a resolution apart from "take care of it yourself" I'm guessing this will not be worked on any time soon.

joshka-oai contributor · 7 months ago

Reopening this as the workarounds aren't really the best - especially if you want commit messages and commits to be part of what Codex manages for you. Ideally signing should work in the following scenarios which are fairly common (I've used all three as recently as yesterday):

gpg
ssh
1password

oratnikov · 7 months ago

+1. Having GPG signature for Codex would be highly appreciated.

je4yfc · 2 months ago

If Codex signs commits, it should sign them as Codex, not as the human operator. Then --signoff can be used by a human reviewer to explicitly indicate they reviewed the AI-generated code and accept responsibility for it.

Otherwise, because Codex activity is tied to a human's username and account. Bad actors could push low-quality or unreviewed AI-generated code in a way that feigns being human-authored. That undermines attribution, accountability, and auditability.

AchintyaAshok · 1 month ago

Has there been any update or guidance on this issue? Personally I feel like having to manually re-sign the commits through vscode or through git commands after the PR has been opened defeats the purpose of a true cloud handoff to codex.