From 1da505b66dc5831872c2d8abe9fd73d01585efa6 Mon Sep 17 00:00:00 2001
From: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
Date: Mon, 17 Aug 2026 00:19:08 +0100
Subject: [PATCH] fix(darwin): sign Git tags when signByDefault is enabled

The nix-darwin module only set commit.gpgsign, so annotated tags were
left unsigned even with signByDefault = true. The home-manager module
already covers both because home-manager derives commit.gpgSign and
tag.gpgSign from signing.signByDefault. Set tag.gpgsign alongside
commit.gpgsign so both modules behave the same, and update the option
description and README comments to mention tags.
---
 README.md                 | 6 +++---
 modules/darwin-module.nix | 3 +++
 modules/options.nix       | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index fc8bba5..3ebd466 100644
--- a/README.md
+++ b/README.md
@@ -282,7 +282,7 @@ Set `system.primaryUser`, then configure the module in the system configuration:
           };
         };
         signingIdentity = "git-signing"; # Select the identity used by Git SSH signing.
-        signByDefault = true; # Sign Git commits with the Secure Enclave-backed key.
+        signByDefault = true; # Sign Git commits and tags with the Secure Enclave-backed key.
       };
     })
   ];
@@ -330,7 +330,7 @@ fingerprint.
       };
     };
     signingIdentity = "git-signing"; # Select the identity used by Git SSH signing.
-    signByDefault = true; # Sign Git commits by default.
+    signByDefault = true; # Sign Git commits and tags by default.
   };
 }
 ```
@@ -378,7 +378,7 @@ Home Manager is optional. Import its module and use the same
       };
     };
     signingIdentity = "git-signing"; # Select the identity used by Git SSH signing.
-    signByDefault = true; # Make Git SSH signing the default for commits.
+    signByDefault = true; # Make Git SSH signing the default for commits and tags.
   };
 }
 ```
diff --git a/modules/darwin-module.nix b/modules/darwin-module.nix
index b372f00..3107c9c 100644
--- a/modules/darwin-module.nix
+++ b/modules/darwin-module.nix
@@ -83,6 +83,9 @@ let
       ${run-as-primary-user "/usr/bin/git"} config --global commit.gpgsign ${
         if cfg.signByDefault then "true" else "false"
       }
+      ${run-as-primary-user "/usr/bin/git"} config --global tag.gpgsign ${
+        if cfg.signByDefault then "true" else "false"
+      }
     ''}
 
     ${github-add-commands}
diff --git a/modules/options.nix b/modules/options.nix
index 09f3b5f..21a8f55 100644
--- a/modules/options.nix
+++ b/modules/options.nix
@@ -71,7 +71,7 @@
     signByDefault = lib.mkOption {
       type = lib.types.bool;
       default = true;
-      description = "Whether Git commits should be SSH-signed by default.";
+      description = "Whether Git commits and tags should be SSH-signed by default.";
     };
 
   };