Would it be possible to add similar support for GPG keys?

I'm still super interested in this because I'd like to be able to more natively use 1password as the central hub to store keys used to sign published artifacts generated in CI. It'd be super-handy if I could easily generate a new signing subkey and revoke one which was compromised when a CI system's cloud provider gets hacked again, all without having to change a thing about the ci logic. Bonus points for also auto-publishing to one or more keyservers on-change. For one example. Right now I have to locally export a key, import that into 1password as a text field, then have automation fetch the armored key before importing it into a local agent, etc. It's kind of a convoluted process compared to something like telling a package signing process to just use a local key agent which can just speak to 1password connect -- for another example. :) Git commit signing is technically on the list, but more of a side effect to me personally.

I think they're hoping everyone storing PGP keys is using them for signing commits and as people discover it can be done with SSH, they'll give up asking for the feature. There are indeed those of us from the '90s still using S/MIME and encrypting blocks to others who want 1Password to be the one stop secret shop.

Big +1 SSH commit signing is fine until you need to rotate keys. Revoking a GPG key will continue to show commits in GitHub (unsure about GitLab) as "verified (expired)". The only way I've found to do the same with SSH keys is to remove the old key completely, but then commits show as "unverified" which defeats the point of supply chain integrity since it's not possible to distinguish a commit that was signed with an old key, or a commit that was not signed, or signed with another key that's not allowed. The alternative is to not rotate signing keys, but then you compromise supply chain integrity further by not ensuring keys are rotated in a timely fashion.

Very interested in this as well.

Hey folks! Love to see the enthusiasm here and we are definitely evaluating this to add going forward 😄 Stay tuned!

GPG support? (like SSH) | 1Password Community

ionos
Occasional Contributor
3 years ago
I think it has all been mentioned before on this thread, but here it does:

File encryption (e.g. for archiving sensitive information)

Git comment signing (we prefer it over signing with SSH keys)

Email encryption/signing

Cheers,
-i
floris_1P
1Password Team
3 years ago
To all the +1'ers in this thread: it would be helpful if you could also describe what you're doing now that requires GPG.
- jau
  New Contributor
  25 days ago
  Signing code commits and releases is my primary use case.
doubleforte
Occasional Contributor
3 years ago
+1
Former Member
3 years ago
+1
Lucent
New Contributor
3 years ago
Seems like interest is dwindling because many were using GPG for commit signing and SSH can do that as well now. Many of us still use GPG for encrypted communication and file storage.
Former Member
3 years ago
I also would appriciate to see the gpg support
Jack_P_1P
1Password Team
3 years ago
Hi @aiguofer:

Thanks for sharing your feedback!

@v1k0d3n:

GitLab.com now supports SSH key commit signing as well: Sign commits with SSH keys | GitLab

With that said, I can definitely see how GPG key management would be helpful as well.

Jack
Former Member
3 years ago
I just had to switch to Mac for a new job and finding myself having to copy over my GPG keys... it took me quite a few tries to remember my key passphrase and would love to just store it in 1password, but it'd be great if I could store it along with my private keys so they can be easily used in different computers.
Former Member
3 years ago
GitHub isn't the only git repository provider. I'm trying to use it for GitLab, as an example.
XIII
Super Contributor
3 years ago
Now that GitHub supports signing commits via SSH (and 1Password supports that too!) I no longer need GPG support...