How to fix error: gpg failed to sign the data: gpg: signing failed: Unusable secret key (key revoked) in Git

First, check which GPG key Git is configured to use:

git config --global user.signingkey

Then verify the status of this key in your GPG keyring:

gpg --list-secret-keys --keyid-format=long

Look for your key in the output. A revoked key will show [revoked] or have an r flag. The output might look like:

sec   rsa4096/ABC123DEF456 2020-01-15 [SC] [revoked: 2024-06-01]
      ABCD1234EFGH5678IJKL9012MNOP3456QRST7890
uid           [revoked] Your Name <[email protected]>

Since revoked keys cannot be used, create a new GPG key:

gpg --full-generate-key

Follow the prompts:
1. Select key type: RSA and RSA (option 1) or ECC for modern systems
2. Key size: 4096 bits for RSA (recommended)
3. Expiration: Set an expiration date (1-2 years recommended)
4. Enter your name and email (must match your Git identity)
5. Set a strong passphrase

After generation, list your keys to get the new key ID:

gpg --list-secret-keys --keyid-format=long

Note the key ID after sec rsa4096/ (e.g., ABC123DEF456789).

Update Git to use your new GPG key:

git config --global user.signingkey YOUR_NEW_KEY_ID

Replace YOUR_NEW_KEY_ID with the key ID from the previous step.

If you haven't enabled commit signing, you can do so with:

git config --global commit.gpgsign true

Verify the configuration:

git config --global --get user.signingkey

Export your new public key:

gpg --armor --export YOUR_NEW_KEY_ID

Copy the entire output including the -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP PUBLIC KEY BLOCK----- lines.

For GitHub:
1. Go to Settings > SSH and GPG keys > New GPG key
2. Paste the key and click "Add GPG key"

For GitLab:
1. Go to User Settings > GPG Keys
2. Paste the key and click "Add key"

You may also want to remove the revoked key from these platforms to avoid confusion.

Create a test signed commit to verify everything works:

git commit --allow-empty -S -m "Test signed commit"

If successful, verify the signature:

git log --show-signature -1

You should see output indicating a valid signature:

gpg: Signature made Mon 01 Jan 2024 12:00:00 PM UTC
gpg: Good signature from "Your Name <[email protected]>"

If you have another valid (non-revoked) key you'd like to use instead:

gpg --list-secret-keys --keyid-format=long

Find a key without the [revoked] status and configure Git to use it:

git config --global user.signingkey EXISTING_VALID_KEY_ID

Make sure the email associated with this key matches your Git configuration:

git config --global user.email
gpg --list-keys EXISTING_VALID_KEY_ID

The emails should match for verified commits on GitHub/GitLab.