Does not adhere to gpg sign commit rule

Resolved 💬 4 comments Opened Nov 4, 2025 by Srini-B Closed Mar 14, 2026

💡 Likely answer: A maintainer (bolinfest, collaborator) responded on this thread — see the highlighted reply below.

What version of Codex is running?

0.53.0

What subscription do you have?

Pro

Which model were you using?

gpt-5-codex high, gpt-5 high

What platform is your computer?

Darwin 25.1.0 arm64 arm

What issue are you seeing?

I have noticed this on every other session where I ask the model to commit the changes. I have configured the git commit using GPG code sign, turned on and using 1Password to maintain the GPG key. So, every other git commit method that I use outside this CLI asks for authentication if 1Password is logged in and then commits it with the GPG sign. But Codex alone here doesn't ask for that permission, and it fails a couple of times. So it turns off GPG sign for this local repository and then commits the changes.

What steps can reproduce the bug?

019a4f2b-4239-7333-9226-d5f32ba9ab01

Enable GPG code-sign and have 1password, locked or unlocked, doesn't matter. Ask the model to commit the changes. It doesn't adhere to the standard methods and turns it off.

What is the expected behavior?

_No response_

Additional information

_No response_

View original on GitHub ↗

4 Comments

bolinfest collaborator · 9 months ago

Are you running with --dangerously-bypass-approvals-and-sandbox/--yolo or any other changes to the default sandbox?

It's possible the default sandbox is getting in the way of accessing the resources required to GPG sign. You can test this with:

codex debug seatbelt --full-auto -- git commit -am "docs: mention dev port override"

Also, we make the .git folder within a repo read-only by default on macOS today.

Srini-B · 9 months ago

I do have sandbox_mode = "danger-full-access and this line on AGENTS.md

When a shell command fails with “failed in sandbox”, use the permission request tool (with with_escalated_permissions) to ask the user for approval before retrying.

codex debug seatbelt --full-auto -- git commit -am "changes to dialer screen infos"
zsh: correct 'git' to '.git' [nyae]? n
fatal: Unable to create '/Users/cyron/Documents/BeeBox/GIS/fintrack/ikit-m/.git/index.lock': Operation not permitted

<details>
<summary>Full Config</summary>

Core (root defaults)

notify = ["/Users/cyron/.codex/notify.sh"]
model = "gpt-5"
approval_policy = "on-request" # untrusted|on-failure|on-request|never
sandbox_mode = "workspace-write" # read-only|workspace-write|danger-full-access
profile = "yolo"
tool_output_token_limit = 25000
model_reasoning_summary_format = "experimental"

Extra settings that only apply when `sandbox = "workspace-write"`.

[sandbox_workspace_write]

Allow the command being run inside the sandbox to make outbound network

requests. Disabled by default.

network_access = true

UI & notifications (can be toggled by installer)

[tui]

Desktop notifications from the TUI: boolean or filtered list. Default: false

Examples: true | ["agent-turn-complete", "approval-requested"]

notifications = true

Centralized feature flags — booleans only

show_raw_agent_reasoning = true
hide_agent_reasoning = false

[features]
web_search_request = true
unified_exec = false
streamable_shell = false
rmcp_client = true
apply_patch_freeform = false
view_image_tool = true
experimental_sandbox_command_assessment = false
ghost_commit = false
enable_experimental_windows_sandbox = false

---- Profiles (override only what differs from root) -----------------------

[profiles.balanced]
approval_policy = "on-request"
sandbox_mode = "workspace-write"
[profiles.balanced.features]
web_search_request = true

[profiles.safe]
approval_policy = "on-failure"
sandbox_mode = "workspace-write"
[profiles.safe.features]
web_search_request = false

[profiles.minimal]
model_reasoning_effort = "minimal"
[profiles.minimal.features]
web_search_request = false

[profiles.yolo]
approval_policy = "never"
sandbox_mode = "danger-full-access"
model = "gpt-5.1-codex-max"
model_reasoning_effort = "high"
exec_timeout_ms = 900000
[profiles.yolo.features]
web_search_request = true

</details>

etraut-openai contributor · 6 months ago

Reviewing old (possibly stale and no-longer-relevant) bug reports. Are you still seeing this with the latest version of Codex?

This issue is very specific, and it hasn't been submitted by any other users, so it hasn't been a high priority for us to look at. You may want to do some additional investigation and diagnosis on your own. You could clone the codex code base and compile it locally, then pair with codex to look for the issue.

Srini-B · 5 months ago

Apologies for the late reply. This is no longer an issue.