1

I'm currently seeing this message near my Git commits, even though I'm signing them using "git commit -S":

enter image description here

When I check Settings > SSH and GPG Keys, I see the same GPG key Id (see below).

enter image description here

When I run $git config --global user.signingkey, I get the following result. I've added Xs and Ys to hide the actual value, but the first half is the key listed in "Subkeys" (from the above screenshot), and the second half is the key listed in "Key ID" (again, from the above screenshot):

01XXXXXXXXXXXXXXXXXXXXAYYYYYYYYYYYYYA012

What else do I need to do so that my commits will show-up as Verified?

WEFX
  • 8,298
  • 8
  • 66
  • 102

2 Answers2

2

As documented in "Statuses with vigilant mode enabled"

Unverified means any of the following is true:

  • The commit is signed but the signature could not be verified.
  • The commit is not signed and the committer has enabled vigilant mode.
  • The commit is not signed and an author has enabled vigilant mode.

Double-check which key is actually used locally, when you are signing commits.

As mentioned in "Signing commits"

If you have multiple keys or are attempting to sign commits or tags with a key that doesn't match your committer identity, you should tell Git about your signing key.

Check git config --global user.signingkey (as in here)

The OP WEFX adds in the comments:

I think my problem was my global config email address was set to a different email address.
I fixed that, created a new GPG key, and started over w/ a new branch as well.
Now, my commits are listed as "Verified", and I'm able to push.

VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • I've run the signingkey command you mentioned and I've listed the output in my question now. It seems okay to me, but maybe the subkey is the problem? – WEFX Nov 09 '21 at 13:13
  • @WEFX Strange. At this point, for testing, I would create a separate key, register it following https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key, and try to use it in a test GitHub repository, to see if that new one works. – VonC Nov 09 '21 at 14:01
  • I think my problem was my global config email address was set to a different email address. I fixed that, created a new GPG key, and started over w/ a new branch as well. Now, my commits are listed as "Verified", and I'm able to push. Thanks @VonC . – WEFX Nov 09 '21 at 17:42
2

I think my specific problem was caused by my config email address not matching the email on the GPG key. I checked my email by running this:

git config --global user.email

and noticed the returned email was an alternate email address of mine. I set the email value to the correct address, generated a new key, started w/ a new branch, and now all of my commits are listed as "Verified". More importantly, I'm able to push to the desired branch as well!

(Note - I'm not sure if it's 100% necessary to generate a new key and new branch, etc. I just wanted to start clean and eliminate anymore problems)

WEFX
  • 8,298
  • 8
  • 66
  • 102