{"version":"2.1.274","anchor":"git-taggpg-signing-config-keys-defined-but-apparently-unuse","canonical_anchor":"git-taggpg-signing-config-keys-defined-but-apparently-unuse","heading":"Git tag\/GPG signing config keys defined but apparently unused","tier":"soon","area":"Git Security","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274\/e\/git-taggpg-signing-config-keys-defined-but-apparently-unuse","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274","markdown":"### Git tag\/GPG signing config keys defined but apparently unused\n\nNew git config entries for tag and commit signing (like tag.gpgSign, gpg.format) added, purpose unclear\n\n**Unclear.** Whether these new keys and forced values are actually applied anywhere, or just defined, is not shown by the evidence.\n\n**What**\n\nA new regular expression matching git signing-related configuration keys, such as `tag.gpgsign`, `user.signingkey`, `gpg.format`, and `gpg.program`, was added, along with a paired list of key\/forced-value combinations like `tag.gpgSign` set to `false` and `gpg.ssh.defaultKeyCommand` set to empty.\n\n**Why**\n\nThis extends the earlier work that let Claude Code trust and automatically configure git signing settings for commits, now recognizing more signing-related keys such as tag signing settings, though the finding doesn't show these new entries actually being applied yet.\n\n- Area: Git Security\n- Tier: Nothing to try yet\n- Useful: 1\/5\n- Signal: 3\/5\n- Present in the build but not switched on"}