carloscuesta / carloscuesta/gitmoji-cli

Yubikey PIN prompt appears twice on Windows when signing commits using SSH key

Open
#1,424 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
4.8k
Forks
212
PR merge metrics
No merged PRs in 30d

Description

### Describe the bug

I'm using gitmoji-cli on Windows with Git configured to sign commits using an SSH key stored on a Yubikey. Everything works correctly except for one issue: when I commit using gitmoji-cli, I'm prompted to enter my Yubikey PIN twice.

This only happens on Windows. On Linux, the PIN prompt is shown once via the shell and then the commit proceeds as expected. On Windows, normally a single system dialog appears asking for the PIN — but when using gitmoji-cli, I see one shell prompt and one system dialog, effectively asking for the PIN twice.

Here’s some more context:

- Git is set up to sign commits using an SSH key backed by a physical Yubikey.
- This behavior only happens with gitmoji-cli. Regular git commit only prompts once (as expected).
- It seems like the commit signing is being triggered twice in some way.

Would be great if this could be investigated or if there's a workaround! Let me know if more logs or setup info would help.

### Reproduction

1. Git is configured like this:
```ini
[user]
signingKey = C:/Users/KMatuszak/.ssh/id_ed25519_sk
[commit]
gpgsign = true
[gpg]
format = ssh
```

2. Run a normal Git commit:
```bash
git commit -m "test"
```
Only one system prompt appears asking for the Yubikey PIN.

3. Run:
```bash
gitmoji -c
```
You're prompted twice for the PIN: once in the terminal and once via system UI.

### System Info

```Shell
System:
OS: Windows 10 10.0.19045
CPU: (24) x64 AMD Ryzen 9 5900X 12-Core Processor
Memory: 9.10 GB / 31.92 GB
Binaries:
Node: 23.11.0 - C:\Program Files\nodejs\node.EXE
npm: 11.3.0 - C:\Program Files\nodejs\npm.CMD
Browsers:
Internet Explorer: 11.0.19041.4355
```

### Validations

- [x] Follow our [Code of Conduct](https://github.com/carloscuesta/gitmoji-cli/blob/master/CODE_OF_CONDUCT.md)
- [x] Read the [Contributing Guide](https://github.com/carloscuesta/gitmoji-cli/blob/master/.github/CONTRIBUTING.md).
- [x] Check that there isn't already an issue that reports the same bug to avoid creating duplicates.
- [x] Check that this is a concrete bug. For Q&A, please open a GitHub Discussion instead.
- [x] The provided reproduction is a [minimal reproducible](https://stackoverflow.com/help/minimal-reproducible-example) of the bug.

Contributor guide

Open the contributing guide

Research direction

No source file or test is named in the report. Start by reproducing the Windows behavior with `gitmoji -c` and `git commit`, then trace how each command invokes Git signing; done means the gitmoji flow produces only the expected single Yubikey PIN prompt.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, javascript
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.