2

Suddenly, all of my commits (my entire history it seems) in all of my repos show as "unverified". Until quite recently, I'm pretty sure all of my commits were marked as verified, and that this change occurred in the past few days. But I can't figure out why or how to fix it.

I have a valid key in my list of GPG keys in settings, and the Key ID there corresponds to the key ID in the user section of my .gitconfig and to the GPG key used in my git client (Tower). The e-mail used in both .gitconfig and my git client is also among the list of verified e-mails in my GPG key in my GitHub settings. And the GPG key ID associated with each commit on GitHub matches the valid GPG key in GitHub settings, my git client, and my git settings.

Why do all my GitHub commits show as unverified, especially when they used to show as verified? How do I get them to correctly show as verified?

orome
  • 45,163
  • 57
  • 202
  • 418
  • 2
    clicking on that 'Unverified' Button shows that "The key that signed this is expired." – l4zs May 19 '21 at 19:04
  • @l4zs But it hasn't. As I said it's valid still, as I can confirm by checking the expiration date. – orome May 19 '21 at 19:08
  • Also if I attempt to [add the public key](https://docs.github.com/en/github/authenticating-to-github/managing-commit-signature-verification/adding-a-new-gpg-key-to-your-github-account#adding-a-gpg-key) that I'm using for commits to my GitHub account, I can't because (as expected) it is already in use there. – orome May 19 '21 at 19:18
  • 2
    Clearly *they* (GitHub) think the key is expired. As to why, you'll have to ask them (GitHub support). Note that it's the GPG key that is (purportedly) expired; SSH keys are irrelevant here. – torek May 20 '21 at 03:04

2 Answers2

3

Even though the GitHub GPG UX says the key is currently in use, it may still be necessary to update it with a newly exported key if the expiration date has been extended.

However there is no way to simply update the key, and an attempt to upload one with an updated expiration date fails with a message saying that the key is already in use (confusing), the only path is to delete the existing key first, but this meets with what appears to be a dead end with a message (in bold, no less):

Any commits you signed with this key will become unverified after removing it.

Forge ahead though and delete the existing key and then upload a recently exported one (with any relevant extension to the expiration date) and — dire warning notwithstanding — the commits will show as verified again.

orome
  • 45,163
  • 57
  • 202
  • 418
  • 1
    The UX needs to make it clearer that the commits will be verified again if an updated key is re-uploaded. (GH is addressing this so the message may change in the near future.) – orome May 22 '21 at 14:37
3

clicking on that 'Unverified' Button shows that "The key that signed this is expired."

Not anymore, since May 2022:

Improved verification of historic Git commit signatures

GitHub will now verify Git commit signatures and show commits as "Verified" even if their public GPG signing keys are expired or revoked (but not compromised).
You can also upload GPG keys that are expired or revoked to your GitHub user profile.

Using GPG or S/MIME, you can sign Git commits.
These commits are marked "Verified" in GitHub's web interface, giving others confidence that they come from a trusted source because they carry their committer's signature.

GPG keys often expire or are revoked when no longer used.

Previously, when a public GPG key stored in a GitHub user profile was expired or revoked, all commits that had ever been signed with that key would be shown as "Unverified" on GitHub.
That raised unnecessary concern since the commits were validly signed before their key was expired or revoked.

Now, when a user's GPG key expires or is revoked for a reason other than being compromised, GitHub will continue showing commits that were previously signed with that key as "Verified."

You can also upload GPG keys that are expired or revoked.

Besides maintaining trust in commits’ sources, this allows GPG keys to be added or rotated for greater security without losing the “Verified” status of previously signed commits.

https://i0.wp.com/user-images.githubusercontent.com/1767415/170838635-6bcb83f0-013b-42b2-844a-c6fc2d4dc287.png?ssl=1

VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • Gotta love the deflection. The previous behavior didn’t just “raise unnecessary concern”, it was flat out broken. – orome Jun 01 '22 at 01:52