How to fix gpg: BAD signature from "User Name <email@example.com>" in Git

GitINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 186 views

This GPG error appears when verifying a signed Git commit or tag and the signature does not match the content. This indicates the signed content was modified after signing or there is a key mismatch issue.

Quick fix

Fixes gpg: BAD signature from "User Name <email@example.com>"

# For a commit
git verify-commit <commit-sha>

# For a tag
git verify-tag <tag-name>

# See signature details in log
git log --show-signature -1 <commit-sha>
  1. Verify the signature details manually
  2. Check your GPG key configuration
  3. Trust your GPG key
  4. Force use of a specific subkey
git — error
# For a commit
git verify-commit <commit-sha>
# For a tag
git verify-tag <tag-name>
# See signature details in log
git log --show-signature -1 <commit-sha>
gpg: BAD signature from "User Name <email@example.com>"

What this error means

When you verify a GPG-signed commit or tag in Git using commands like `git verify-commit`, `git verify-tag`, or `git merge --verify-signatures`, GPG checks that the cryptographic signature matches the content that was signed. A "BAD signature" means this verification failed. This is a serious warning because it indicates one of two things: either the content was modified after it was signed (which could indicate tampering), or there's a technical issue with how the signature was created or is being verified. Unlike "Can't check signature: public key not found" (which just means you don't have the signer's key), a BAD signature means GPG has the key and verified that the signature is invalid. This warrants investigation.

Typical symptoms

  • Git displays 'gpg: BAD signature from "Name <email>"'
  • Commits show as 'B' (bad) in git log with %G? format
  • git merge --verify-signatures fails and aborts the merge
  • git verify-commit or git verify-tag returns an error
  • GitHub or GitLab marks commits as having invalid signatures
  • Pull requests are blocked due to signature verification policies

Common causes

  1. GPG is using a different subkey than the one that created the signature
  2. The commit or tag content was modified after signing (rare, potential tampering)
  3. Key trust level not set properly in GPG keyring
  4. Signing key has multiple subkeys and wrong one is being used for verification
  5. Corrupted or incomplete key import
  6. Git signing configuration points to wrong key ID
  7. macOS GPG Suite or Homebrew GPG version conflicts

How to fix "gpg: BAD signature from "User Name <email@example.com>""

1Verify the signature details manually

First, check what GPG reports for the specific commit or tag:

bash
# For a commit
git verify-commit <commit-sha>

# For a tag
git verify-tag <tag-name>

# See signature details in log
git log --show-signature -1 <commit-sha>

Note the key ID mentioned in the error. This tells you which key GPG is trying to use for verification.

2Check your GPG key configuration

Verify which key Git is configured to use for signing:

bash
# Check global signing key
git config --global user.signingkey

# Check local signing key (overrides global)
git config --local user.signingkey

# List your GPG keys
gpg --list-secret-keys --keyid-format=long

Ensure the key ID in your Git config matches the key you intend to use. The key should show [SC] or [S] capability for signing.

3Trust your GPG key

If the key is not trusted, GPG may report signature issues. Set the trust level:

bash
gpg --edit-key <your-key-id>

In the GPG prompt:

bash
gpg> trust
# Select option 5 (ultimate trust) for your own keys
gpg> quit

Then try verifying the signature again.

4Force use of a specific subkey

If you have multiple subkeys and GPG is choosing the wrong one, append ! to force a specific key:

bash
# Get your subkey fingerprints
gpg --list-keys --keyid-format=long <your-key-id>

# Configure Git to use a specific subkey (note the ! at the end)
git config --global user.signingkey <SUBKEY_ID>!

The exclamation mark tells GPG to use that exact key rather than selecting automatically.

5Re-import the signing key

If the key may be corrupted, export and re-import it:

bash
# Export public key
gpg --export --armor <key-id> > public.key

# Export private key (store securely!)
gpg --export-secret-keys --armor <key-id> > private.key

# Delete and re-import
gpg --delete-secret-keys <key-id>
gpg --delete-keys <key-id>
gpg --import public.key
gpg --import private.key

Make sure to set the trust level again after re-importing.

6Set GPG_TTY for terminal access (macOS/Linux)

GPG needs terminal access for passphrase prompts. Add this to your shell profile:

bash
# Add to ~/.bashrc, ~/.zshrc, or equivalent
export GPG_TTY=$(tty)

Then reload your shell:

bash
source ~/.zshrc  # or ~/.bashrc

This is especially important in VS Code integrated terminals or when running Git commands from scripts.

7Fix macOS GPG installation conflicts

On macOS, conflicts between Homebrew GPG and GPG Suite can cause issues:

bash
# Check which gpg is being used
which gpg
gpg --version

# If using Homebrew, install pinentry-mac
brew install pinentry-mac

# Configure GPG to use it
echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf

# Restart the GPG agent
gpgconf --kill gpg-agent

If you upgraded macOS recently, reinstalling may help:

bash
brew reinstall gnupg
# Or for GPG Suite
brew reinstall --cask gpg-suite

Advanced notes

### Investigating Potential Tampering

A BAD signature on a commit you didn't create could indicate tampering. Before assuming configuration issues, verify:

1. Check the commit history: git log --oneline --graph
2. Compare with the remote: git diff <remote>/<branch>
3. Verify with the original signer if possible

If the commit came from a trusted source and shows a bad signature, it's most likely a key configuration issue rather than actual tampering.

### Subkey Selection Behavior

GPG automatically selects the most recent signing-capable subkey unless told otherwise. This can cause issues if:
- You created a new subkey after signing old commits
- The signing subkey also has authentication capability
- You're verifying commits signed with an old subkey

To check which subkey was used for a signature:

bash
git log --format='%G? %GK %GS' -1 <commit>

### Disabling Signature Verification

If you need to merge despite signature issues (not recommended for production):

bash
# One-time merge without verification
git merge --no-verify-signatures <branch>

# Disable signature verification globally (not recommended)
git config --global commit.gpgsign false

Warning: Only do this if you've confirmed the signature issue is a configuration problem, not actual tampering.

### CI/CD Pipeline Considerations

In CI environments, GPG keys may not be available. To handle this:

bash
# Import key from environment variable
echo "$GPG_PRIVATE_KEY" | gpg --batch --import

# Trust the key non-interactively
echo -e "5\ny\n" | gpg --batch --command-fd 0 --edit-key <key-id> trust quit

Or configure CI to skip signature verification if appropriate for your security requirements.

Frequently asked questions

What does "gpg: BAD signature from "User Name <email@example.com>"" mean?
When you verify a GPG-signed commit or tag in Git using commands like git verify-commit, git verify-tag, or git merge --verify-signatures, GPG checks that the cryptographic signature matches the content that was signed. A "BAD signature" means this verification failed. This is a serious warning because it indicates one of two things: either the content was modified after it was signed (which could indicate tampering), or there's a technical issue with how the signature was created or is being verified.
How do I fix "gpg: BAD signature from "User Name <email@example.com>""?
This GPG error appears when verifying a signed Git commit or tag and the signature does not match the content. This indicates the signed content was modified after signing or there is a key mismatch issue.
What causes "gpg: BAD signature from "User Name <email@example.com>""?
GPG is using a different subkey than the one that created the signature The commit or tag content was modified after signing (rare, potential tampering) Key trust level not set properly in GPG keyring
Is the "gpg: BAD signature from "User Name <email@example.com>"" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading