How to fix error: gpg failed to sign the data: gpg: signing failed: No secret key in Git

GitINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 154 views

The 'gpg failed to sign the data' error with 'No secret key' occurs when Git tries to sign a commit but GPG cannot find the private key configured in your Git settings. This typically happens when your signing key ID is misconfigured, the key was never imported, or GPG is looking in the wrong keyring.

Quick fix

Fixes error: gpg failed to sign the data: gpg: signing failed: No secret key

# Check global signing key
git config --global user.signingkey

# Check local repository override
git config --local user.signingkey

# Check effective value (combines global + local)
git config user.signingkey

Verify which key Git is trying to use
List your available GPG secret keys
Import your GPG key (if missing)
Fix the key ID format in Git config

git — error

$# Check global signing key
git config --global user.signingkey
# Check local repository override
git config --local user.signingkey
# Check effective value (combines global + local)
git config user.signingkey
error: gpg failed to sign the data: gpg: signing failed: No secret key

What this error means

The "gpg failed to sign the data" error with "No secret key" indicates that GPG cannot locate the private key needed to create a cryptographic signature for your commit. Git invokes GPG to sign commits when `commit.gpgsign` is enabled or when you use `git commit -S`, but the key specified in `user.signingkey` doesn't exist in your GPG keyring. This error differs from "Unusable secret key" (which means the key exists but is expired or otherwise invalid). "No secret key" means GPG literally cannot find any matching private key material. The key ID in your Git config may be incorrect, the key may never have been imported to this machine, or you might be using the wrong GPG home directory. Common scenarios include setting up a new machine and forgetting to import your GPG keys, using a key ID format that GPG doesn't recognize, or having separate keyrings for different GPG versions (GPG 1.x vs 2.x).

Typical symptoms

Git commits fail with 'error: gpg failed to sign the data' and 'No secret key'
Error occurs when commit.gpgsign is true or using git commit -S
Running 'gpg --list-secret-keys' shows no keys or not the expected key
The signing key works on another machine but not this one
Error appeared after setting up a new computer or reinstalling OS
Git config shows a key ID but 'gpg --list-secret-keys <keyid>' returns nothing
Previously working commit signing stops after upgrading GPG version
CI/CD pipelines fail with GPG signing errors

Common causes

GPG signing key was never imported to this machine (most common on new setups)
user.signingkey in Git config contains an incorrect or mistyped key ID
Key ID format mismatch (short ID vs long ID vs fingerprint)
GPG keyring location differs from where Git/GPG is looking (GNUPGHOME mismatch)
Using GPG 2.x but key was only imported to GPG 1.x keyring (or vice versa)
Private key exists but only the public key was imported
SSH signing configured but GPG signing key specified (or vice versa)
Subkey ID specified but only primary key exists in keyring

How to fix "error: gpg failed to sign the data: gpg: signing failed: No secret key"

1Verify which key Git is trying to use

First, check what signing key Git is configured to use:

bash

# Check global signing key
git config --global user.signingkey

# Check local repository override
git config --local user.signingkey

# Check effective value (combines global + local)
git config user.signingkey

If this returns a key ID, note it down. If it returns nothing but you're still getting the error, Git might be trying to use a default key based on your email address.

Also check if GPG signing is enabled:

bash

git config commit.gpgsign
# Returns "true" if enabled

2List your available GPG secret keys

Check what keys actually exist in your GPG keyring:

bash

# List all secret (private) keys
gpg --list-secret-keys --keyid-format=long

# Example output when keys exist:
# /home/user/.gnupg/pubring.kbx
# -----------------------------
# sec   rsa4096/ABC123DEF456789AB 2023-01-15 [SC] [expires: 2025-01-15]
#       XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
# uid           [ultimate] Your Name <your@email.com>
# ssb   rsa4096/DEF789GHI123456CD 2023-01-15 [E]

If this command returns no output or doesn't show the expected key, then the key hasn't been imported to this machine.

Compare the key ID from Git config with what's listed. Note that key IDs can appear in different formats:
- Short ID: Last 8 characters (e.g., 456789AB)
- Long ID: Last 16 characters (e.g., ABC123DEF456789AB)
- Fingerprint: Full 40 characters

3Import your GPG key (if missing)

If the key doesn't exist on this machine, you need to import it:

From a backup file:

bash

# Import private key from backup
gpg --import private-key-backup.asc

# You'll be prompted for the key's passphrase

From another machine:

bash

# On the machine that has the key, export it:
gpg --export-secret-keys --armor YOUR_KEY_ID > private-key.asc

# Securely transfer the file to the new machine, then import:
gpg --import private-key.asc

# Delete the exported file after import
rm private-key.asc

From a keyserver (public key only - won't help for signing):

bash

# This only imports PUBLIC keys, not secret keys
# You cannot sign with just a public key
gpg --keyserver keyserver.ubuntu.com --recv-keys YOUR_KEY_ID

After importing, verify the key appears:

bash

gpg --list-secret-keys --keyid-format=long

4Fix the key ID format in Git config

If the key exists but Git can't find it, the ID format might be wrong:

bash

# Get the correct long format key ID
gpg --list-secret-keys --keyid-format=long

# Look for the line starting with "sec" and note the ID after the slash
# sec   rsa4096/ABC123DEF456789AB 2023-01-15 [SC]
#              ^^^^^^^^^^^^^^^^^ This is your long key ID

Update Git to use the correct key ID:

bash

# Set using long format (recommended)
git config --global user.signingkey ABC123DEF456789AB

# Or use the full fingerprint (most reliable)
gpg --list-secret-keys --keyid-format=long --fingerprint
# Get the fingerprint (40-char string without spaces)
git config --global user.signingkey XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Test the fix:

bash

# Test GPG signing directly
echo "test" | gpg --clearsign

# Test a Git commit
git commit --allow-empty -S -m "Test signed commit"

5Generate a new GPG key (if you don't have one)

If you've never created a GPG key or need a new one:

bash

# Generate a new GPG key pair
gpg --full-generate-key

# When prompted:
# - Key type: (1) RSA and RSA (default)
# - Key size: 4096 (recommended)
# - Expiration: 1y or 2y (recommended over no expiration)
# - Real name: Your Name
# - Email: your@email.com (must match Git config)
# - Passphrase: Choose a strong passphrase

After generation, get your key ID:

bash

gpg --list-secret-keys --keyid-format=long
# Note the ID after "sec rsa4096/"

Configure Git to use it:

bash

git config --global user.signingkey YOUR_NEW_KEY_ID
git config --global commit.gpgsign true

Add the public key to GitHub/GitLab:

bash

# Export public key
gpg --armor --export YOUR_KEY_ID

# Copy the output and add it to:
# GitHub: Settings > SSH and GPG keys > New GPG key
# GitLab: User Settings > GPG Keys

6Check GPG home directory (GNUPGHOME)

GPG might be looking in the wrong directory for keys:

bash

# Check current GPG home directory
gpgconf --list-dirs homedir
# Default is usually ~/.gnupg

# Check if GNUPGHOME environment variable is set
echo $GNUPGHOME

# List keys in a specific directory
gpg --homedir /path/to/.gnupg --list-secret-keys

If keys exist in a different location:

bash

# Option 1: Set GNUPGHOME permanently in your shell profile
echo 'export GNUPGHOME="/correct/path/.gnupg"' >> ~/.bashrc
source ~/.bashrc

# Option 2: Copy keys to default location
cp -r /old/path/.gnupg/* ~/.gnupg/

For Git specifically, you can also configure the GPG program:

bash

# Tell Git which GPG to use
git config --global gpg.program gpg2

# Or specify full path
git config --global gpg.program /usr/bin/gpg

7Fix GPG version mismatch

Different GPG versions (1.x vs 2.x) use different keyring formats:

bash

# Check installed GPG versions
which gpg gpg2
gpg --version
gpg2 --version 2>/dev/null

# List keys with each version
gpg --list-secret-keys
gpg2 --list-secret-keys 2>/dev/null

If keys appear in one version but not the other:

bash

# Export from the version that has keys
gpg --export-secret-keys --armor > keys-backup.asc

# Import to the version Git is using
gpg2 --import keys-backup.asc

Make sure Git uses the correct GPG version:

bash

# Check current GPG program setting
git config gpg.program

# Set to gpg2 if that's where your keys are
git config --global gpg.program gpg2

# Or explicitly use gpg (version 1.x)
git config --global gpg.program gpg

8Configure GPG agent for passphrase caching

If GPG prompts work but Git signing fails, the GPG agent may need configuration:

bash

# Ensure GPG agent is running
gpg-agent --daemon

# Set GPG_TTY for terminal-based passphrase prompts
export GPG_TTY=$(tty)
echo 'export GPG_TTY=$(tty)' >> ~/.bashrc

# Test that GPG agent works
echo "test" | gpg --clearsign

For GUI-based passphrase entry, install pinentry:

bash

# Ubuntu/Debian
sudo apt install pinentry-gtk2
# or
sudo apt install pinentry-gnome3

# macOS
brew install pinentry-mac

# Configure GPG to use it
echo "pinentry-program /usr/bin/pinentry-gtk-2" >> ~/.gnupg/gpg-agent.conf
gpgconf --kill gpg-agent

For macOS with GPG Suite:

bash

echo "pinentry-program /usr/local/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf
gpgconf --kill gpg-agent

9Disable GPG signing temporarily (workaround)

If you need to commit urgently while troubleshooting:

bash

# Commit without signing (one-time)
git commit --no-gpg-sign -m "Your commit message"

# Disable signing globally (temporary)
git config --global commit.gpgsign false

# Disable signing for current repository only
git config commit.gpgsign false

Remember to re-enable signing once fixed:

bash

git config --global commit.gpgsign true

For CI/CD environments where signing isn't needed:

yaml

# .gitlab-ci.yml or GitHub Actions
env:
  GIT_COMMITTER_NAME: CI Bot
  GIT_COMMITTER_EMAIL: ci@example.com
script:
  - git config commit.gpgsign false
  - git commit -m "Automated commit"

Advanced notes

### Understanding GPG Key Architecture

GPG keys have a hierarchical structure:
- Primary key: Used for certification (signing other keys)
- Subkeys: Used for signing, encryption, or authentication

When Git signs commits, it typically uses a signing subkey (marked [S]). If you export only the primary key or only certain subkeys, signing may fail.

bash

# Show full key structure
gpg --list-secret-keys --keyid-format=long
# Look for [S] capability - that's the signing key

# sec   rsa4096/ABC123... [SC]     <- Primary key (Sign + Certify)
# ssb   rsa4096/DEF456... [E]      <- Encryption subkey
# ssb   rsa4096/GHI789... [S]      <- Signing subkey (this one signs commits)

### Matching Keys to Email Addresses

If user.signingkey isn't set, GPG tries to find a key matching your Git email:

bash

# Check Git email
git config user.email

# Key uid must contain this email
gpg --list-secret-keys user@example.com

If emails don't match, either:
1. Set user.signingkey explicitly
2. Add the email as a uid to your key: gpg --edit-key KEYID then adduid

### SSH Signing (Alternative to GPG)

Git 2.34+ supports signing commits with SSH keys instead of GPG:

bash

# Configure SSH signing
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub

# Commits will now be signed with your SSH key
git commit -S -m "SSH-signed commit"

This avoids GPG complexity entirely if you already have SSH keys set up.

### Troubleshooting Checklist

If still having issues, verify each step:

bash

# 1. GPG works standalone
echo "test" | gpg --clearsign
# Should produce signed output

# 2. Correct key ID in Git config
git config user.signingkey
gpg --list-secret-keys --keyid-format=long | grep -i <that-id>
# Should find the key

# 3. Email matches
git config user.email
gpg --list-secret-keys
# Email in uid should match Git email

# 4. GPG agent running
pgrep gpg-agent
# Should return a PID

# 5. Correct GPG program
which $(git config gpg.program || echo gpg)
# Should exist and be executable

### WSL (Windows Subsystem for Linux) Considerations

WSL has separate keyrings from Windows:

bash

# Keys in Windows GPG are NOT visible in WSL
# You must import keys separately in WSL

# Option 1: Import to WSL
gpg --import /mnt/c/path/to/exported-key.asc

# Option 2: Use Windows GPG from WSL
git config --global gpg.program "/mnt/c/Program Files (x86)/GnuPG/bin/gpg.exe"

### macOS Keychain Integration

On macOS with GPG Suite, you may need to configure keychain access:

bash

# Install GPG Suite (includes pinentry-mac)
brew install --cask gpg-suite

# Configure pinentry
echo "pinentry-program /usr/local/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf
echo "use-agent" >> ~/.gnupg/gpg.conf

# Restart agent
gpgconf --kill gpg-agent

# Store passphrase in Keychain
echo "default-cache-ttl 600" >> ~/.gnupg/gpg-agent.conf
echo "max-cache-ttl 7200" >> ~/.gnupg/gpg-agent.conf

### CI/CD Pipeline Configuration

For automated environments, you typically need to import keys at runtime:

yaml

# GitHub Actions example
- name: Import GPG key
  run: |
    echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --import
    git config --global user.signingkey ${{ secrets.GPG_KEY_ID }}
    git config --global commit.gpgsign true

Store the key as a base64-encoded secret:

bash

gpg --export-secret-keys --armor KEY_ID | base64 -w 0

Frequently asked questions

What does "error: gpg failed to sign the data: gpg: signing failed: No secret key" mean?: The "gpg failed to sign the data" error with "No secret key" indicates that GPG cannot locate the private key needed to create a cryptographic signature for your commit. signingkey doesn't exist in your GPG keyring. This error differs from "Unusable secret key" (which means the key exists but is expired or otherwise invalid).
How do I fix "error: gpg failed to sign the data: gpg: signing failed: No secret key"?: The 'gpg failed to sign the data' error with 'No secret key' occurs when Git tries to sign a commit but GPG cannot find the private key configured in your Git settings. This typically happens when your signing key ID is misconfigured, the key was never imported, or GPG is looking in the wrong keyring.
What causes "error: gpg failed to sign the data: gpg: signing failed: No secret key"?: GPG signing key was never imported to this machine (most common on new setups) user.signingkey in Git config contains an incorrect or mistyped key ID Key ID format mismatch (short ID vs long ID vs fingerprint)
Is the "error: gpg failed to sign the data: gpg: signing failed: No secret key" error serious?: It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading

📚Git Official Documentation
💬
gpg failed to sign the data fatal: failed to write commit object - Stack Overflow(Stack Overflow)
💬
Git error - gpg failed to sign data - Stack Overflow(Stack Overflow)
💬
How to understand the 'gpg failed to sign the data' problem in git - GitHub Gist(Stack Overflow)
📖
Generating a new GPG key - GitHub Docs(Official Docs)
📖
Telling Git about your signing key - GitHub Docs(Official Docs)
📖
Git - Signing Your Work(Official Docs)
📖
GPG Configuration - GnuPG Manual(Official Docs)

How to fix error: gpg failed to sign the data: gpg: signing failed: No secret key in Git

Quick fix

What this error means

Typical symptoms

Common causes

How to fix "error: gpg failed to sign the data: gpg: signing failed: No secret key"

Advanced notes

Frequently asked questions

Related errors

Official resources & further reading