Using Yubikey for Github Auth and Git Signed Commits

---

1) Install openSSH (Apples’s built in doesn’t support the hardware key setup with ssh)

brew install openssh libfido2  
 
echo 'export PATH="/opt/homebrew/opt/openssh/bin:$PATH"' >> ~/.zshrc  
source ~/.zshrc

2) Prepare YubiKey

brew install ykman
 
# Format and set pin
ykman fido reset 
ykman fido access change-pin
ykman fido info
# Should show remaning attempts

3) Generate a YubiKey-backed SSH keys (ed25519-sk) for signing & Auth

# Touch only SSH key for github auth
ssh-keygen -t ed25519-sk -C "github-auth" -f ~/.ssh/id_github_auth_sk
 
# Touch + Fido PIN SSH key for signing git commits
ssh-keygen -t ed25519-sk -O verify-required -C "git-signing" -f ~/.ssh/id_git_signing_sk

4) Configure Git to sign every commit using SSH signing

git config --global gpg.format ssh
git config --global commit.gpgsign true
git config --global user.signingkey ~/.ssh/id_git_signing_sk.pub
 
echo "$(git config --global user.email) $(cat ~/.ssh/id_git_signing_sk.pub)" > ~/.config/git/allowed_signers

5) Configure SSH

cat > ~/.ssh/config <<'EOF'
Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_github_auth_sk
  IdentitiesOnly yes
EOF

6) Add SSH keys to github

cat ~/.ssh/id_github_auth_sk.pub | pbcopy
# GitHub → Settings → SSH and GPG keys → New SSH key
# (Type: Authentication key)
 
cat ~/.ssh/id_git_signing_sk.pub| pbcopy 
# GitHub → Settings → SSH and GPG keys → New SSH key 
# (Type: Signing Key)

7) Verify

# Verify Auth
ssh -T [email protected] 
# should ask for touch
 
# Verify Sign
git commit --allow-empty -m "signed commit test"
git log --show-signature -1