WSL 2でgitコミットにSSH鍵で署名できなかったので直した記録

2026-02-01

起こっていた問題

署名付きコミットをしようとしたら以下のエラーが出ました。

code:console

$ git commit -S -m "test"

error: Couldn't get agent socket?

fatal: failed to write commit object

やったこと

Gitのログを見て調べたところ、ssh-agentが動いていないと分かりました。パスフレーズを覚えておいてソケット経由で繋げるようにしてくれるやつ。

code:console

$ GIT_TRACE=1 GIT_SSH_COMMAND="ssh -v" git commit -m "test" -S

20:18:25.198037 git.c:463 trace: built-in: git commit -m test -S

20:18:25.198916 run-command.c:659 trace: run_command: git-ssh-default-key

20:18:25.215223 run-command.c:659 trace: run_command: ssh-keygen -Y sign -n git -f /tmp/.git_signing_key_tmpcG7dMz -U /tmp/.git_signing_buffer_tmplSJb58

error: Couldn't get agent socket?

fatal: failed to write commit object

$ printenv SSH_AUTH_SOCK

$ ssh-add -l

Could not open a connection to your authentication agent.

$ systemctl --user status ssh-agent.service

○ ssh-agent.service - OpenSSH Agent

Loaded: loaded (/usr/lib/systemd/user/ssh-agent.service; static)

Active: inactive (dead)

Docs: man:ssh-agent(1)

ssh-agent.serviceを動かすようにしても良かったのだけど、中身を見てみるとデフォルトのssh-agent.serviceはそのままでは動かしづらそうです。

code:console

$ systemctl --user cat ssh-agent.service

# /usr/lib/systemd/user/ssh-agent.service

Description=OpenSSH Agent

Documentation=man:ssh-agent(1)

Before=graphical-session-pre.target

ConditionPathExists=/etc/X11/Xsession.options

Wants=dbus.socket

After=dbus.socket

# If you need to pass extra arguments to ssh-agent, you can use "systemctl

# --user edit ssh-agent.service" to add a drop-in unit with contents along

# these lines:

# ExecStart=

# ExecStart=/usr/lib/openssh/agent-launch start -- -t 1200

ExecStart=/usr/lib/openssh/agent-launch start

ExecStopPost=/usr/lib/openssh/agent-launch stop

自前のunitファイルを書いて動かす方法も取れますがメンテナンスが面倒なので、今回はgpg-agent.serviceのSSH対応を代わりに使うこととしました。

前提としてgpg-agent.socketが動いているとします。たとえば以下のページのように。

gpg-agentのSSH対応についてはマニュアルで以下のように書かれています。

On Unix platforms the OpenSSH Agent protocol is always enabled, but gpg-agent will only set the SSH_AUTH_SOCK variable if the option enable-ssh-support is given. Some Linux distributions use the presence of this option to decide whether the old ssh-agent shall be started.

...

In this mode of operation, the agent does not only implement the gpg-agent protocol, but also the agent protocol used by OpenSSH (through a separate socket or via Named Pipes) or the protocol used by PuTTY. Consequently, this allows one to use the gpg-agent as a drop-in replacement for the ssh-agent.

SSH keys, which are to be used through the agent, need to be added to the gpg-agent initially through the ssh-add utility. When a key is added, ssh-add will ask for the password of the provided key file and send the unprotected key material to the agent; this causes the gpg-agent to ask for a passphrase, which is to be used for encrypting the newly received key and storing it in a gpg-agent specific directory.

Once a key has been added to the gpg-agent this way, the gpg-agent will be ready to use the key.

...

code:console

$ cat ~/.gnupg/gpg-agent.conf

enable-ssh-support

$ systemctl --user restart gpg-agent.service

code:sh

# 以下を ~/.bashrc 等に追記

export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"

code:console

$ printenv SSH_AUTH_SOCK

/run/user/1000/gnupg/S.gpg-agent.ssh

$ ssh-add -l

The agent has no identities.

code:console

$ git commit -S -m "test"

error: Couldn't find key in agent?

fatal: failed to write commit object