Commit Signing using SSH

[Lakshit Singh Bisht]

My repo hosting is primarily on Github and I use ssh keys for commit verification. I use Gitlab, Codeberg, Bitbucket and Gitea as mirror and Sourceforge just for version update and release files. I added the ssh keys to Github, Gitlab, Codeberg, Bitbucket and Gitea. Out of these, all other than Bitbucket are showing verified and signing commits (checked) but its not working for Bitbucket even when I already have added the SSH keys. I don't know whats the issue with this and every other mirror/git hosting is working fine and no problems but this is not working in Bitbucket. 

I have tried google search, youtube, chatgpt, reading docs but still not able to solve. Though one thing I would like to clarify is that I won't be switching to pgp because this signing already works and it would take a headache to replace ssh by pgp in all hosting services. So, I want to work with ssh as its working literally everywhere except Bitbucket.

What steps can I take to sign the commits using SSH only? Is it even possible to sign with SSH here or I will have to continue with unverified commits only?

[Ben · Accepted solution]

Hi @Lakshit Singh Bisht 

Welcome to the Bitbucket Cloud community!

We have a guide for signing commits specifically using SSH - the format of the command is a little confusing - but it's not using GPG (despite this term being included in the command), it's explicitly stating to use SSH:

• https://support.atlassian.com/bitbucket-cloud/docs/use-ssh-keys-to-sign-commits/

Hope this helps.

Cheers!

- Ben (Bitbucket Cloud Support)

[Lakshit Singh Bisht]

Thanks for the answer. It says in page that right now, only commits from cli are signed. But I do cli --> github --> automated workflow --> bitbucket (along with Gitlab, Codeberg, Gitea and Sourceforge).

So, I guess it's not possible right now, until rules get changed.