How to fix remote: error: GH006: Protected branch update failed - commits must be signed in Git

GitINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 146 views

This error occurs when pushing to a GitHub branch that requires signed commits, but your commits are unsigned. You must configure GPG or SSH commit signing and re-sign your commits before pushing.

Quick fix

Fixes remote: error: GH006: Protected branch update failed - commits must be signed

gpg --list-secret-keys --keyid-format=long

Check if you have a GPG key configured
Generate a new GPG key (if needed)
Add your GPG key to GitHub
Configure Git to use your signing key

git — error

$gpg --list-secret-keys --keyid-format=long
remote: error: GH006: Protected branch update failed - commits must be signed

What this error means

This error indicates that GitHub is rejecting your push because the target branch has branch protection rules requiring all commits to be cryptographically signed. GitHub supports this as a security measure to verify that commits genuinely come from the person they claim to be from. When branch protection is enabled with the "Require signed commits" option, every commit in your push must have a valid GPG or SSH signature that GitHub can verify. Unsigned commits, or commits signed with an unverified key, will be rejected with this GH006 error. This protection is commonly enabled on main/master branches in enterprise environments and open-source projects to prevent impersonation attacks where someone could forge commit author information.

Typical symptoms

git push fails with 'GH006: Protected branch update failed'
Error message specifically mentions 'commits must be signed'
Push works to unprotected branches but fails on protected ones
Commits show as 'Unverified' in GitHub's web interface
CI/CD pipelines fail when trying to push to protected branches

Common causes

Commits were made without GPG or SSH signing configured
GPG key is not added to your GitHub account
GPG key has expired or been revoked
SSH signing is configured but SSH key is not set up for signing in GitHub
Rebased or amended commits lost their signatures
Git is not configured to sign commits automatically
The signing key email doesn't match your GitHub verified email

How to fix "remote: error: GH006: Protected branch update failed - commits must be signed"

1Check if you have a GPG key configured

First, verify whether you have any GPG keys available for signing:

bash

gpg --list-secret-keys --keyid-format=long

If you see output with sec entries, you have keys available. Note the key ID after the algorithm (e.g., rsa4096/3AA5C34371567BD2 - the part after the slash is your key ID).

If no keys are listed, you'll need to generate one or use SSH signing instead.

2Generate a new GPG key (if needed)

If you don't have a GPG key, create one:

bash

gpg --full-generate-key

Select the following options:
- Key type: RSA and RSA (default)
- Key size: 4096 bits (recommended)
- Expiration: Choose based on your security policy (1-2 years is common)
- Enter your name and the email address associated with your GitHub account

After generation, get your key ID:

bash

gpg --list-secret-keys --keyid-format=long

3Add your GPG key to GitHub

Export your public key:

bash

gpg --armor --export YOUR_KEY_ID

Copy the entire output including -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP PUBLIC KEY BLOCK-----.

Then add it to GitHub:
1. Go to GitHub.com → Settings → SSH and GPG keys
2. Click "New GPG key"
3. Paste your public key and save

Alternatively, use the GitHub CLI:

bash

gpg --armor --export YOUR_KEY_ID | gh gpg-key add -

4Configure Git to use your signing key

Tell Git which key to use for signing:

bash

git config --global user.signingkey YOUR_KEY_ID

Enable automatic commit signing:

bash

git config --global commit.gpgsign true

If you're on macOS and using GPG Suite, you may need to set the GPG program:

bash

git config --global gpg.program gpg

On some systems, you might need to specify the full path:

bash

git config --global gpg.program $(which gpg)

5Re-sign your existing commits

If you have unsigned commits that need to be pushed, you must re-sign them. For the most recent commit:

bash

git commit --amend --no-edit -S

For multiple commits, use interactive rebase:

bash

# Re-sign the last N commits
git rebase --exec 'git commit --amend --no-edit -S' HEAD~N

Replace N with the number of commits to re-sign. For example, to re-sign the last 3 commits:

bash

git rebase --exec 'git commit --amend --no-edit -S' HEAD~3

Note: This rewrites commit history. If you've already shared these commits, you'll need to force push.

6Push your signed commits

After re-signing, push your changes:

bash

git push

If you rebased and rewrote history, you may need to force push:

bash

git push --force-with-lease

The --force-with-lease flag is safer than --force as it prevents overwriting others' work.

7Alternative: Use SSH signing (Git 2.34+)

If you prefer SSH keys over GPG, Git 2.34+ supports SSH signing:

bash

# Configure SSH signing
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

Add your SSH key to GitHub as a signing key:
1. Go to GitHub.com → Settings → SSH and GPG keys
2. Click "New SSH key"
3. Select "Signing Key" as the key type
4. Paste your public key

SSH signing is simpler to set up if you already use SSH for authentication.

8Verify your commits are signed

Confirm that your commits are properly signed:

bash

git log --show-signature -1

You should see "Good signature" in the output. You can also check on GitHub - signed commits show a "Verified" badge next to them.

To verify all commits in a range:

bash

git log --show-signature HEAD~5..HEAD

Advanced notes

Troubleshooting GPG agent issues: If signing fails with "gpg failed to sign the data", the GPG agent might not be running or configured correctly:

bash

# Restart the GPG agent
gpgconf --kill gpg-agent
gpg-agent --daemon

# For macOS with pinentry-mac
echo "pinentry-program /usr/local/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf
gpgconf --kill gpg-agent

Using different keys for different repositories: You can configure signing on a per-repository basis:

bash

cd your-repo
git config user.signingkey YOUR_WORK_KEY_ID
git config commit.gpgsign true

GitHub Actions and signed commits: If your CI needs to push signed commits, you can use a GPG key stored in secrets:

yaml

- name: Import GPG key
  run: echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --import
- name: Configure signing
  run: |
    git config user.signingkey ${{ secrets.GPG_KEY_ID }}
    git config commit.gpgsign true

Vigilant mode: GitHub offers "vigilant mode" which shows unsigned commits as unverified, even on branches without protection rules. Enable it in Settings → SSH and GPG keys → Vigilant mode.

Key expiration: Monitor your key expiration dates. You can extend a key's expiration without generating a new one:

bash

gpg --edit-key YOUR_KEY_ID
gpg> expire
# Follow prompts to set new expiration
gpg> save

Then re-upload the updated public key to GitHub.

Frequently asked questions

What does "remote: error: GH006: Protected branch update failed - commits must be" mean?: This error indicates that GitHub is rejecting your push because the target branch has branch protection rules requiring all commits to be cryptographically signed. GitHub supports this as a security measure to verify that commits genuinely come from the person they claim to be from. When branch protection is enabled with the "Require signed commits" option, every commit in your push must have a valid GPG or SSH signature that GitHub can verify.
How do I fix "remote: error: GH006: Protected branch update failed - commits must be"?: This error occurs when pushing to a GitHub branch that requires signed commits, but your commits are unsigned. You must configure GPG or SSH commit signing and re-sign your commits before pushing.
What causes "remote: error: GH006: Protected branch update failed - commits must be"?: Commits were made without GPG or SSH signing configured GPG key is not added to your GitHub account GPG key has expired or been revoked
Is the "remote: error: GH006: Protected branch update failed - commits must be" error serious?: It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading

📚Git Official Documentation
📖
GitHub Docs - Signing commits(Official Docs)
📖
GitHub Docs - Require signed commits(Official Docs)
📖
Git Book - Signing Your Work(Official Docs)
📖
GitHub Docs - Telling Git about your signing key(Official Docs)
💬
Stack Overflow - GPG failed to sign the data(Stack Overflow)

How to fix remote: error: GH006: Protected branch update failed - commits must be signed in Git

Quick fix

What this error means

Typical symptoms

Common causes

How to fix "remote: error: GH006: Protected branch update failed - commits must be signed"

Advanced notes

Frequently asked questions

Related errors

Official resources & further reading