2

I have a couple (seemingly random) commits in GitHub that show up as "Unverified". They all have the same GPG key ID (6950332147457958).

enter image description here

Signing happens automatically when I commit locally, and almost always works as intended. My ~/.gitconfig contains

[user]
        email = <email>
        name = <name>
        signingkey = e4839b74088b1dc6b4711b906950332147457958
[commit]
        gpgsign = true

When I run git verify-commit --verbose d54a, I get

tree 914fcd10703dc117510e7ebda7d0146788e86c8d
parent 7d5584a6c1dfbb1a86c953bc67241d0301ed13bb
author <name> <email> 1642192424 -0800
committer <name> <email> 1642192424 -0800

add biquery.jobUser in dev for running queries
gpg: Signature made Fri 14 Jan 2022 12:33:44 PM PST
gpg:                using RSA key E4839B74088B1DC6B4711B906950332147457958
gpg: BAD signature from "<name> <email>" [unknown]

The results don't tell my much about why the signature is bad, and since signing is automatic, and this error only happens occasionally, I'm not sure how to debug this further. The closest issue I've found to mine is https://stackoverflow.com/a/62558802/533209. I was able to get my commits verified by running git rebase --committer-date-is-author-date 7d558, but of course that rewrote the commits and I had to force push, and I still don't know how I got into this situation in the first place.

Here is what looks like the relevant lines from git reflog

eb32512 (refs/original/refs/remotes/origin/user-groups, refs/original/refs/heads/user-groups) HEAD@{4}: commit: <msg 6>
add85ae HEAD@{5}: commit: <msg 5>
d54a560 HEAD@{6}: checkout: moving from main to user-groups
441deb5 (refs/original/refs/remotes/origin/main, refs/original/refs/heads/main) HEAD@{7}: checkout: moving from tf-state-versioning t
o main
bb7fae6 (refs/original/refs/remotes/origin/tf-state-versioning, refs/original/refs/heads/tf-state-versioning) HEAD@{8}: commit (amend
): <msg 4>
977bd11 HEAD@{9}: commit: <msg 4>
441deb5 (refs/original/refs/remotes/origin/main, refs/original/refs/heads/main) HEAD@{10}: checkout: moving from main to tf-state-ver
sioning
441deb5 (refs/original/refs/remotes/origin/main, refs/original/refs/heads/main) HEAD@{11}: checkout: moving from user-groups to main
d54a560 HEAD@{12}: reset: moving to HEAD
d54a560 HEAD@{13}: commit: <msg 3>
7d5584a HEAD@{14}: commit: <msg 2>
4a88332 HEAD@{15}: commit (amend): <msg 1>

All of these commits are from the same shell session, using git commit -m, no IDEs or web commits or any variables like that.

Reese
  • 1,746
  • 1
  • 17
  • 40
  • 1
    Create a test repo and push some commits from all your different machines/environments/IDEs. I bet one of those is misconfigured and doesn't correctly sign, or alters commit messages after signing somehow. – Marco Bonelli Jan 21 '22 at 18:35
  • 1
    These were all from the same machine, same IDE, same method – Reese Jan 21 '22 at 18:49
  • 1
    Well, that is interesting, but I'm afraid we cannot help that much without enough debugging details (like how were the bad commits created and under which conditions), which due to the nature of this "issue" are not present in your post. That's unlucky. Hopefully someone who also experienced this issue finds the post. – Marco Bonelli Jan 21 '22 at 19:15
  • Which debugging details? This is an intermittent issue that I'd like to solve, so I can gather additional info over time if it isn't possible to debug historically – Reese Jan 21 '22 at 19:17
  • I also get this issue sometimes and I've never been able to solve it. I just amend the comment message in someway and it usually rectifies it – bm_i Oct 06 '22 at 07:11

0 Answers0