How to fix error: commit abc1234 does not have a GPG signature in Git

First, check which commits in your branch lack GPG signatures:

git log --show-signature HEAD~10..HEAD

Unsigned commits will show no signature information, while signed commits display:

commit abc1234...
gpg: Signature made Wed Jan 15 10:30:00 2025
gpg: Good signature from "Your Name <[email protected]>"

To see just the signature status in a compact format:

git log --pretty=format:"%h %G? %s" HEAD~10..HEAD

The %G? shows: G = good signature, N = no signature, B = bad signature.

Before signing commits, ensure GPG is properly set up:

# List your GPG keys
gpg --list-secret-keys --keyid-format=long

# Check Git's signing key configuration
git config --get user.signingkey

If no key is configured, set it:

# Get your key ID from the gpg output (e.g., 3AA5C34371567BD2)
git config --global user.signingkey YOUR_KEY_ID

Also ensure your email matches the key:

git config --get user.email

Configure Git to sign all commits by default so you don't need to remember the -S flag:

# Enable globally
git config --global commit.gpgsign true

# Or for just this repository
git config commit.gpgsign true

Now all new commits will be automatically signed with your GPG key.

If you need to sign commits that were already made, use interactive rebase:

# Rebase the last N commits (replace 5 with your count)
git rebase -i HEAD~5 --exec "git commit --amend --no-edit -S"

This replays each commit and signs it. Note that this rewrites history, so:
- Only do this on branches that haven't been pushed, OR
- You'll need to force push afterward: git push --force-with-lease

For all commits since branching from main:

git rebase -i main --exec "git commit --amend --no-edit -S"

If signature verification is optional and you need to merge quickly:

# Merge without verifying signatures
git merge branch-name --no-verify-signatures

# Pull without verification
git pull --no-verify-signatures

If merge.verifySignatures is set in your config, temporarily override it:

git -c merge.verifySignatures=false merge branch-name

Note: This bypasses signature verification for this operation only. If your organization requires signed commits, you should sign them instead.

If GitHub's branch protection requires signed commits but your PR contains unsigned commits, you can use squash merge:

1. Go to the pull request on GitHub
2. Click the dropdown arrow next to "Merge pull request"
3. Select "Squash and merge"

GitHub will create a single new commit signed by GitHub's web-flow key, which satisfies the signed commits requirement.

Important: Regular "Rebase and merge" won't work because GitHub creates new unsigned commits during that process.