How to fix gpg: Can't check signature: No public key in Git

GitBEGINNERLOWUpdated Dec 6, 2025· 141 views

This error occurs when Git tries to verify a GPG-signed commit or tag, but the signer's public key isn't in your local GPG keyring. Import the missing public key from a keyserver or directly from the signer to verify the signature.

Quick fix

Fixes gpg: Can't check signature: No public key

git log --show-signature -1
  1. Identify the missing key ID
  2. Import the public key from a keyserver
  3. Import GitHub's web-flow signing key
  4. Import a public key from a file
git — error
git log --show-signature -1
gpg: Can't check signature: No public key

What this error means

When developers sign Git commits or tags using GPG (GNU Privacy Guard), they create a cryptographic signature using their private key. To verify these signatures, you need the corresponding public key in your GPG keyring. The "gpg: Can't check signature: No public key" error appears when you run commands like `git log --show-signature`, `git verify-commit`, or `git verify-tag`, and GPG cannot find the public key needed to verify the signature. The error message typically includes an RSA key ID (e.g., `RSA key ID A9C5DF4D22E99998D9875A5110C01C5A2F6059E7`) which identifies the missing key. This is not a critical error that prevents Git operations - unsigned commits and tags work normally. However, you cannot verify the authenticity of signed commits until you import the signer's public key. This verification is particularly important in security-conscious workflows where you need to confirm that commits came from trusted developers.

Typical symptoms

  • Running 'git log --show-signature' shows 'gpg: Can't check signature: No public key'
  • The 'git verify-commit <commit-hash>' command fails with the missing key error
  • Verifying signed tags with 'git tag -v <tag>' shows the error
  • GitHub shows 'Verified' badges but local verification fails
  • CI/CD pipelines fail when configured to verify commit signatures
  • The error includes an RSA key ID that you don't have in your keyring

Common causes

  1. The commit or tag was signed by someone whose public key you haven't imported
  2. Commits made through GitHub's web interface are signed by GitHub's web-flow key, which isn't in your keyring by default
  3. The signer hasn't published their public key to a keyserver
  4. Your GPG keyring was reset or you're on a new machine without imported keys
  5. The keyserver you're using doesn't have the required public key
  6. Corporate or organizational commits may use internal signing keys not on public keyservers

How to fix "gpg: Can't check signature: No public key"

1Identify the missing key ID

First, find the key ID that GPG is looking for. Run the verification command and note the key ID:

bash
git log --show-signature -1

The output will show something like:

bash
gpg: Signature made Mon 01 Jan 2024 12:00:00 PM UTC
gpg:                using RSA key A9C5DF4D22E99998D9875A5110C01C5A2F6059E7
gpg: Can't check signature: No public key

Note the key ID (the long hexadecimal string after "using RSA key").

2Import the public key from a keyserver

Try to fetch the public key from a keyserver using the key ID:

bash
gpg --keyserver hkps://keys.openpgp.org --recv-keys <KEY_ID>

For example:

bash
gpg --keyserver hkps://keys.openpgp.org --recv-keys A9C5DF4D22E99998D9875A5110C01C5A2F6059E7

If the default keyserver doesn't have the key, try alternative keyservers:

bash
# MIT keyserver
gpg --keyserver hkps://pgp.mit.edu --recv-keys <KEY_ID>

# Ubuntu keyserver
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys <KEY_ID>
3Import GitHub's web-flow signing key

If the commits were made through GitHub's web interface (merges, edits via UI), you need GitHub's web-flow key:

bash
curl https://github.com/web-flow.gpg | gpg --import

This imports the key GitHub uses to sign commits made through their web interface. You can verify it was imported:

bash
gpg --list-keys noreply@github.com

For commits signed by other GitHub users, their public keys may be available at:

bash
curl https://github.com/<username>.gpg | gpg --import
4Import a public key from a file

If you have the public key as a file (often provided in project documentation or by the developer directly):

bash
gpg --import publickey.asc

Or import from a URL where the key is hosted:

bash
curl https://example.com/developer-key.asc | gpg --import

Some projects include signing keys in their repository:

bash
gpg --import KEYS
# or
gpg --import signing-key.pub
5Verify the signature again

After importing the public key, verify the signature again:

bash
# For commits
git verify-commit <commit-hash>
# or
git log --show-signature -1

# For tags
git verify-tag <tag-name>
# or
git tag -v <tag-name>

A successful verification shows:

bash
gpg: Signature made Mon 01 Jan 2024 12:00:00 PM UTC
gpg:                using RSA key A9C5DF4D22E99998D9875A5110C01C5A2F6059E7
gpg: Good signature from "Developer Name <dev@example.com>" [unknown]
6Set the trust level for imported keys (optional)

After importing a key, GPG may show "[unknown]" trust level. If you trust the key's authenticity, you can set the trust level:

bash
gpg --edit-key <KEY_ID>

At the gpg> prompt, type:

bash
gpg> trust

Select a trust level:
- 1 = I don't know or won't say
- 2 = I do NOT trust
- 3 = I trust marginally
- 4 = I trust fully
- 5 = I trust ultimately (use for your own keys only)

Then save and exit:

bash
gpg> save

Note: Setting trust levels is part of the GPG web of trust model and should be done carefully. Only set high trust for keys you've verified through out-of-band means.

Advanced notes

### Automating Key Imports in CI/CD

For CI/CD pipelines that need to verify signatures, pre-import the required keys:

bash
# Import multiple keys in a script
gpg --keyserver hkps://keys.openpgp.org --recv-keys KEY1 KEY2 KEY3

# Or import from a team keyring file stored in the repo
gpg --import .gpg-keys/team-keys.asc

### Verifying All Commits in a Range

To check signatures for multiple commits:

bash
# Show signatures for last 10 commits
git log --show-signature -10

# Verify signatures for commits in a branch
git log --show-signature main..feature-branch

### Using git merge --verify-signatures

Git can verify signatures during merges:

bash
git merge --verify-signatures feature-branch

This will refuse to merge if any commits have invalid or missing signatures.

### GPG Key Distribution Best Practices

If you're signing commits and want others to verify them:

1. Upload to keyservers: gpg --keyserver hkps://keys.openpgp.org --send-keys <YOUR_KEY_ID>
2. Add to GitHub: Settings > SSH and GPG keys > New GPG key
3. Include in project: Add your public key to a KEYS file in the repository
4. Document: Include verification instructions in your README

### Handling Expired or Revoked Keys

If verification shows an expired or revoked key:

bash
gpg: Signature made Mon 01 Jan 2024
gpg: Note: This key has expired!

The signature may still be valid if it was made before the key expired. To see key details:

bash
gpg --list-keys --keyid-format LONG <KEY_ID>

### Corporate Environments

In enterprise settings, you may need to:

1. Configure a corporate keyserver: Add to ~/.gnupg/gpg.conf:

bash
keyserver hkps://keys.internal.company.com

2. Import corporate root keys that sign developer keys
3. Use LDAP or Active Directory integration for key distribution

Frequently asked questions

What does "gpg: Can't check signature: No public key" mean?
When developers sign Git commits or tags using GPG (GNU Privacy Guard), they create a cryptographic signature using their private key. To verify these signatures, you need the corresponding public key in your GPG keyring. The "gpg: Can't check signature: No public key" error appears when you run commands like git log --show-signature, git verify-commit, or git verify-tag, and GPG cannot find the public key needed to verify the signature.
How do I fix "gpg: Can't check signature: No public key"?
This error occurs when Git tries to verify a GPG-signed commit or tag, but the signer's public key isn't in your local GPG keyring. Import the missing public key from a keyserver or directly from the signer to verify the signature.
What causes "gpg: Can't check signature: No public key"?
The commit or tag was signed by someone whose public key you haven't imported Commits made through GitHub's web interface are signed by GitHub's web-flow key, which isn't in your keyring by default The signer hasn't published their public key to a keyserver
Is the "gpg: Can't check signature: No public key" error serious?
It is a low-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading