Some resources:

• Using git2's Repository::commit_signed: How to correctly create GPG-signed commits? rust-lang/git2-rs#507. It looks like you still need to sign the commit via GPG yourself.
  • Another example of signing the commit: https://blog.hackeriet.no/signing-git-commits-in-rust/
• An implementation for git-revise: Add support for GPG-signed commits (#46) mystor/git-revise#73

There's a few APIs in git-branchless which are capable of creating commits:

• Repo::create_commit.
• Repo::cherry_pick_commit and Repo::cherry_pick_fast.
• Repo::amend_fast.

These commands are capable of creating commits:

• git move.
  • Note that it can create commits in-memory or on-disk via git rebase, so both cases will have to be handled.
  • The calling code is in core::rewrite::execute. We'll probably want to add some configuration to to indicate that any commits created in this way should be signed. Also CherryPickFastOptions.
• git amend.
• git reword.
• git sync and git restack: these should be handled fairly straightforwardly by whatever changes are made to support git move.
• git record: experimental command, so not a priority at the moment.
• git branchless snapshot create: these commits don't need to be signed since they're not supposed to be really committed/pushed.

These data structures will probably have to be updated to carry GPG information. You should be able to add a field and then follow the compiler errors to see where should be updated to use the new field:

• AmendFastOptions.
• CherryPickFastOptions
• ExecuteRebasePlanOptions
• MoveOptions
• There is no explicit data structure for Repo::create_commit options, but it would be reasonable to add one.

In the long term, it would be best to contribute GPG-signing code to https://github.com/gitext-rs/git2-ext in some capacity. Either we can contribute it directly there, or contribute it to git-branchless first and extract it afterwards.