Web sessions: git config pre-wires SSH commit signing but the signing key is an empty file — all commits land unsigned/Unverified

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code on the web (remote execution container) ships a global git config that pre-wires SSH commit signing — gpg.format=ssh, user.signingkey=/home/claude/.ssh/commit_signing_key.pub, commit.gpgsign=true in /root/.gitconfig — but the key it points at is a 0-byte file with no private half anywhere. Commits still succeed (something in the execution path suppresses the signing that stock git would fail loudly on) and come out unsigned (git log --format='%G?' → N), so every session-authored commit shows "Unverified" on GitHub. Nothing inside the container can fix it — there is no key material. Note that provisioning a key alone wouldn't be enough either: commits are authored as Claude <noreply@anthropic.com>, an address no user's GitHub account can claim, so verification needs a platform-level answer (sign server-side at the git proxy with an Anthropic-registered key, provision+register per-environment keys, or drop the dangling config so the state is honest).

What Should Happen?

Either commits from web sessions are actually signed and verify on GitHub, or the image doesn't carry half-wired signing config (commit.gpgsign=true pointing at an empty key file). Currently it claims signing is on while producing unsigned commits.

Error Messages/Logs

$ git config --show-origin commit.gpgsign
file:/root/.gitconfig   true
$ git config --show-origin user.signingkey
file:/root/.gitconfig   /home/claude/.ssh/commit_signing_key.pub
$ ls -la /home/claude/.ssh/commit_signing_key.pub
-rw-r--r-- 1 claude claude 0 Mar 31 13:31 /home/claude/.ssh/commit_signing_key.pub
$ git log -1 --format='%G?'
N

Steps to Reproduce

1. Start any Claude Code on the web session (claude.ai/code) with a connected GitHub repo.
2. Run git config --show-origin commit.gpgsign (→ true) and ls -la /home/claude/.ssh/commit_signing_key.pub (→ 0 bytes, no private key present).
3. Make any commit and push. git log -1 --format='%G?' shows N; the commit renders "Unverified" on GitHub.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Code on the web (claude.ai/code hosted session) — container image, git 2.43.0, Linux 6.18.5

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

Impact: cosmetic under squash-merge (GitHub signs the squash commit, so default-branch history verifies), but blocking for repos enforcing branch protection "require signed commits", and noisy for repos auditing signature state on branches. Observed 2026-08-03 in a web session; the empty key file is dated Mar 31, suggesting the provisioning step was sketched but never shipped.