How to fix error: commit abc1234 does not have a GPG signature in Git

GitINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 159 views

This Git error occurs when you attempt to merge or pull with signature verification enabled, but one or more commits lack a GPG signature. Fix it by signing the commits or disabling signature verification for the operation.

Quick fix

Fixes error: commit abc1234 does not have a GPG signature

git log --show-signature HEAD~10..HEAD
  1. Identify which commits are unsigned
  2. Verify your GPG key is configured
  3. Enable automatic commit signing
  4. Sign existing unsigned commits with interactive rebase
git — error
git log --show-signature HEAD~10..HEAD
error: commit abc1234 does not have a GPG signature

What this error means

When Git performs a merge or pull operation with the `--verify-signatures` flag (or with `merge.verifySignatures` set to true in your config), it checks that every commit being merged has a valid GPG signature. If any commit lacks a signature, Git refuses to proceed and displays this error. GPG (GNU Privacy Guard) signatures provide cryptographic proof that commits were made by the person who holds the corresponding private key. This is a security measure to prevent commits from being forged or tampered with. Many organizations and projects require signed commits to ensure code integrity. This error commonly appears when: - You're merging a branch containing unsigned commits - Your repository or CI pipeline has enabled signature verification - A branch protection rule requires signed commits - You're pulling from a remote with signature verification enabled

Typical symptoms

  • Git merge fails with 'fatal: Commit [hash] does not have a GPG signature'
  • Git pull with --verify-signatures rejects unsigned commits
  • CI/CD pipelines fail when merging pull requests
  • GitHub shows 'Merging is blocked' because base branch requires signed commits
  • Push to protected branch is rejected due to unsigned commits

Common causes

  1. Commits were created without the -S flag or without commit.gpgsign=true (most common)
  2. Repository has merge.verifySignatures=true in git config
  3. Using --verify-signatures flag with git merge or git pull
  4. Branch protection rules require signed commits on the target branch
  5. Some commits in the branch were made before GPG signing was configured
  6. Rebased or amended commits lost their signatures
  7. Commits were made on a machine without GPG key access

How to fix "error: commit abc1234 does not have a GPG signature"

1Identify which commits are unsigned

First, check which commits in your branch lack GPG signatures:

bash
git log --show-signature HEAD~10..HEAD

Unsigned commits will show no signature information, while signed commits display:

bash
commit abc1234...
gpg: Signature made Wed Jan 15 10:30:00 2025
gpg: Good signature from "Your Name <your@email.com>"

To see just the signature status in a compact format:

bash
git log --pretty=format:"%h %G? %s" HEAD~10..HEAD

The %G? shows: G = good signature, N = no signature, B = bad signature.

2Verify your GPG key is configured

Before signing commits, ensure GPG is properly set up:

bash
# List your GPG keys
gpg --list-secret-keys --keyid-format=long

# Check Git's signing key configuration
git config --get user.signingkey

If no key is configured, set it:

bash
# Get your key ID from the gpg output (e.g., 3AA5C34371567BD2)
git config --global user.signingkey YOUR_KEY_ID

Also ensure your email matches the key:

bash
git config --get user.email
3Enable automatic commit signing

Configure Git to sign all commits by default so you don't need to remember the -S flag:

bash
# Enable globally
git config --global commit.gpgsign true

# Or for just this repository
git config commit.gpgsign true

Now all new commits will be automatically signed with your GPG key.

4Sign existing unsigned commits with interactive rebase

If you need to sign commits that were already made, use interactive rebase:

bash
# Rebase the last N commits (replace 5 with your count)
git rebase -i HEAD~5 --exec "git commit --amend --no-edit -S"

This replays each commit and signs it. Note that this rewrites history, so:
- Only do this on branches that haven't been pushed, OR
- You'll need to force push afterward: git push --force-with-lease

For all commits since branching from main:

bash
git rebase -i main --exec "git commit --amend --no-edit -S"
5Merge without signature verification (if allowed)

If signature verification is optional and you need to merge quickly:

bash
# Merge without verifying signatures
git merge branch-name --no-verify-signatures

# Pull without verification
git pull --no-verify-signatures

If merge.verifySignatures is set in your config, temporarily override it:

bash
git -c merge.verifySignatures=false merge branch-name

Note: This bypasses signature verification for this operation only. If your organization requires signed commits, you should sign them instead.

6Handle GitHub branch protection (squash merge)

If GitHub's branch protection requires signed commits but your PR contains unsigned commits, you can use squash merge:

1. Go to the pull request on GitHub
2. Click the dropdown arrow next to "Merge pull request"
3. Select "Squash and merge"

GitHub will create a single new commit signed by GitHub's web-flow key, which satisfies the signed commits requirement.

Important: Regular "Rebase and merge" won't work because GitHub creates new unsigned commits during that process.

Advanced notes

### GPG Agent and Passphrase Caching

If you're prompted for your GPG passphrase repeatedly, configure gpg-agent to cache it:

bash
# ~/.gnupg/gpg-agent.conf
default-cache-ttl 3600
max-cache-ttl 86400

Restart the agent:

bash
gpgconf --kill gpg-agent

### Signing Merge Commits

When merging with --verify-signatures, you can also sign the merge commit itself:

bash
git merge --verify-signatures -S feature-branch

This both verifies incoming signatures AND signs the resulting merge commit.

### CI/CD Pipeline Signing

In CI environments, you'll need to:
1. Import your GPG private key securely (use secrets management)
2. Configure Git with the key ID
3. Ensure the GPG agent can run non-interactively

Example GitHub Actions snippet:

yaml
- name: Import GPG key
  run: |
    echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import
    git config --global user.signingkey ${{ secrets.GPG_KEY_ID }}
    git config --global commit.gpgsign true

### SSH Signing (Git 2.34+)

As an alternative to GPG, Git 2.34+ supports SSH key signing:

bash
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub

This uses your existing SSH key for signing, which is simpler than managing GPG keys.

### Verifying Signatures From GitHub Web Interface

Commits made directly on GitHub (via the web interface, squash merges, or merge button) are signed by GitHub's internal key. To verify these locally, add GitHub's public key to your GPG keyring:

bash
curl https://github.com/web-flow.gpg | gpg --import

### Common GPG Troubleshooting

If signing fails with "gpg failed to sign the data":

bash
# Ensure GPG can access TTY
export GPG_TTY=$(tty)

# Test GPG is working
echo "test" | gpg --clearsign

# On macOS with pinentry issues
brew install pinentry-mac
echo "pinentry-program /usr/local/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf

Frequently asked questions

What does "error: commit abc1234 does not have a GPG signature" mean?
verifySignatures set to true in your config), it checks that every commit being merged has a valid GPG signature. If any commit lacks a signature, Git refuses to proceed and displays this error. GPG (GNU Privacy Guard) signatures provide cryptographic proof that commits were made by the person who holds the corresponding private key.
How do I fix "error: commit abc1234 does not have a GPG signature"?
This Git error occurs when you attempt to merge or pull with signature verification enabled, but one or more commits lack a GPG signature. Fix it by signing the commits or disabling signature verification for the operation.
What causes "error: commit abc1234 does not have a GPG signature"?
Commits were created without the -S flag or without commit.gpgsign=true (most common) Repository has merge.verifySignatures=true in git config Using --verify-signatures flag with git merge or git pull
Is the "error: commit abc1234 does not have a GPG signature" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading