How to fix gpg: Can't check signature: No public key in Git

First, find the key ID that GPG is looking for. Run the verification command and note the key ID:

git log --show-signature -1

The output will show something like:

gpg: Signature made Mon 01 Jan 2024 12:00:00 PM UTC
gpg:                using RSA key A9C5DF4D22E99998D9875A5110C01C5A2F6059E7
gpg: Can't check signature: No public key

Note the key ID (the long hexadecimal string after "using RSA key").

Try to fetch the public key from a keyserver using the key ID:

gpg --keyserver hkps://keys.openpgp.org --recv-keys <KEY_ID>

For example:

gpg --keyserver hkps://keys.openpgp.org --recv-keys A9C5DF4D22E99998D9875A5110C01C5A2F6059E7

If the default keyserver doesn't have the key, try alternative keyservers:

# MIT keyserver
gpg --keyserver hkps://pgp.mit.edu --recv-keys <KEY_ID>

# Ubuntu keyserver
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys <KEY_ID>

If the commits were made through GitHub's web interface (merges, edits via UI), you need GitHub's web-flow key:

curl https://github.com/web-flow.gpg | gpg --import

This imports the key GitHub uses to sign commits made through their web interface. You can verify it was imported:

gpg --list-keys [email protected]

For commits signed by other GitHub users, their public keys may be available at:

curl https://github.com/<username>.gpg | gpg --import

If you have the public key as a file (often provided in project documentation or by the developer directly):

gpg --import publickey.asc

Or import from a URL where the key is hosted:

curl https://example.com/developer-key.asc | gpg --import

Some projects include signing keys in their repository:

gpg --import KEYS
# or
gpg --import signing-key.pub

After importing the public key, verify the signature again:

# For commits
git verify-commit <commit-hash>
# or
git log --show-signature -1

# For tags
git verify-tag <tag-name>
# or
git tag -v <tag-name>

A successful verification shows:

gpg: Signature made Mon 01 Jan 2024 12:00:00 PM UTC
gpg:                using RSA key A9C5DF4D22E99998D9875A5110C01C5A2F6059E7
gpg: Good signature from "Developer Name <[email protected]>" [unknown]

After importing a key, GPG may show "[unknown]" trust level. If you trust the key's authenticity, you can set the trust level:

gpg --edit-key <KEY_ID>

At the gpg> prompt, type:

gpg> trust

Select a trust level:
- 1 = I don't know or won't say
- 2 = I do NOT trust
- 3 = I trust marginally
- 4 = I trust fully
- 5 = I trust ultimately (use for your own keys only)

Then save and exit:

gpg> save

Note: Setting trust levels is part of the GPG web of trust model and should be done carefully. Only set high trust for keys you've verified through out-of-band means.