Commits signed with my noreply email are seen as "Unverified"

[rosmanov]

Select Topic Area

Bug

Body

GitHub shows GPG-signed commits as "Unverified" with the following error:

The email in this signature doesn’t match the committer email.

I have the "Keep my email addresses private" checkbox turned on in https://github.com/settings/emails and the tip under it states:

We’ll remove your public profile email and use 608192+rosmanov@users.noreply.github.com when...

And the committer email exactly matches that email. Let's take this commit, for example:

$ git --no-pager show --pretty=fuller --show-signature a114408ba4e77cb429676a747d20be33d89a1bea | head -n 10
commit a114408ba4e77cb429676a747d20be33d89a1bea
gpg: Signature made Wed 05 Oct 2022 07:32:24 PM +04
gpg:                using EDDSA key D49983485B84E1A9A3E20157B71B9215E724E859
gpg: Good signature from "Ruslan Osmanov (Git) <rrosmanov@gmail.com>" [ultimate]
gpg:                 aka "Ruslan Osmanov (GitHub) <608192+rosmanov@users.noreply.github.com>" [ultimate]
Author:     Ruslan Osmanov <608192+rosmanov@users.noreply.github.com>
AuthorDate: Wed Oct 5 19:32:24 2022 +0400
Commit:     Ruslan Osmanov <608192+rosmanov@users.noreply.github.com>
CommitDate: Wed Oct 5 19:32:24 2022 +0400

But GitHub displays it as "Unverified":

It looks like a bug. If it is not, please help me to fix this issue.

Thanks.

[ilyar]

ilyar/test-gpg@4487ec7

https://github.com/ilyar/test-gpg/commits/main

[ilyar]

$ git commit --help | grep sign
       -s, --signoff
           Add Signed-off-by line by the committer at the end of the commit log message. The meaning of a signoff
       -S[<keyid>], --gpg-sign[=<keyid>]
           GPG-sign commits. The keyid argument is optional and defaults to the committer identity; if specified,
       --no-gpg-sign
           signed.
       designed not to force UTF-8 on projects. If all participants of a particular project find it more convenient

$ git commit -s -m "change title"
$ git --no-pager show --pretty=fuller --show-signature 1c69f1800e6a4ca764d9d0b5027c2ba962cd5b5f
commit 1c69f1800e6a4ca764d9d0b5027c2ba962cd5b5f
Author:     Ilyar <761285+ilyar@users.noreply.github.com>
AuthorDate: Thu Mar 16 11:21:11 2023 +0100
Commit:     Ilyar <761285+ilyar@users.noreply.github.com>
CommitDate: Thu Mar 16 11:21:11 2023 +0100

    change title
    
    Signed-off-by: Ilyar <761285+ilyar@users.noreply.github.com>

ilyar/test-gpg@1c69f18

$ git commit -S -m "use key"
$ git --no-pager show --pretty=fuller --show-signature 4b1fa45ac86305fd955397d95694350fc700f670
commit 4b1fa45ac86305fd955397d95694350fc700f670 (HEAD -> main, origin/main, origin/HEAD)
gpg: Signature made Thu 16 Mar 2023 12:05:34 PM CET
gpg:                using RSA key 01C0F1BCFA480C23C24793E04331FA7A0AF8BF99
gpg: Good signature from "Ilyar <761285+ilyar@users.noreply.github.com>" [ultimate]
Author:     Ilyar <761285+ilyar@users.noreply.github.com>
AuthorDate: Thu Mar 16 12:05:34 2023 +0100
Commit:     Ilyar <761285+ilyar@users.noreply.github.com>
CommitDate: Thu Mar 16 12:05:34 2023 +0100

ilyar/test-gpg@4b1fa45

[nikicat]

I did all the same and it doesn't work - my commits are still "Unverified"

[lasersPew]

When you change your email to GitHub throwaway email, you should add new user id to the GPG key you use when signing commits to GitHub. More info: StackOverflow

[asamahy]

after adding the new ID to the key, remove the old public key from github and add the updated key. your old commits wont be affected.
gpg --armor --export your-key-id

[jimmydju]

You need to add your email 608192+rosmanov@users.noreply.github.com to your local GPG key (follow this) and then re-generate the public key.
Go to github, delete the existing public key and add the newly generated public key. Your next commit/push should be verified by Github now.

[egouldo]

I generated a gpg key for the first time, doing exactly this, and I'm still getting this problem, not a solution to the OP's problem unfortunately.

[idontlikecreatingaccounts]

FIXED: I had an extra whitespace in the git config email address.

[nikicat]

The same issue for me, @rosmanov did you manage to find a solution?

[nikicat]

I've found a solution - you need to remove a digit prefix from the noreply email address (just leave a GitHub username)

[Kristinita]

Type: Question ❓

@nikicat, could you provide more details? Where should the user remove the digit prefix?

1. Local git configuration

Should the user replace the email in the local git configuration? Example:

# [INFO] Get current email
git config --global user.email
17247677+Kristinita@users.noreply.github.com

# [QUESTION] Should the email be like this?
git config --global user.email
Kristinita@users.noreply.github.com

2. E-mail for GPG key

Or perhaps the user should add the GitHub no-reply e-mail to the GPG key without the digit prefix? For example, my page https://github.com/settings/keys:

Should the email address for GPG key not contain 17247677+ in my case?

---

Or did you mean something else?

Thanks.

[nikicat]

Sure, there is no public email in this commit btw

commit 7ea0161dc13754c9c241bdbdebab1b2ec995d34d (HEAD -> journald, origin/journald)
gpg: Signature made Tue Jan  9 11:23:21 2024 UTC
gpg:                using EDDSA key B374CC3950AB7E4CDAAC6986846FFFEFC1039264
gpg: Good signature from "Nikolay Bryskin (GitHub) <nikicat@users.noreply.github.com>" [unknown]
gpg:                 aka "Nikolay Bryskin (GitHub) <329262+nikicat@users.noreply.github.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: B374 CC39 50AB 7E4C DAAC  6986 846F FFEF C103 9264
Author: Nikolay Bryskin <nikicat@users.noreply.github.com>
Date:   Tue Jan 9 10:20:14 2024 +0000

    Add CLA
    
    Signed-off-by: Nikolay Bryskin <nikicat@users.noreply.github.com>

[Kristinita]

But the fact that GitHub e-mail with ID number is Unverified looks like a GitHub flaw.

[Kristinita]

Status: RESOLVED ✔️

Thanks!

[nikicat]

I agree, it should be fixed.

[Aurora12]

The problem still persists. 🙄
I've just lost a lot of time on it — thanks for the solution!

And it looks like I need Aurora12@users.noreply.github.com in git config too. They can't be different. In which case, will everything else on GitHub work, I wonder? 🤔 I mean, GitHub profile attribution, contribution graph, etc...

[wirredfunds]

I fixed this issue!

After two long days of searching, I have finally found out how to fix the issue

The Problem

No, the problem wasn't because the email wasn't in the key itself nor was it because I didn't put it to GitHub.

The problem is that by default, GPG keypairs don't have signing privileges on the main key. This is a security practice done by GnuPG to ensure you can't sign everything with your main key and need to share a subkey.

The Solution

1. Run gpg --list-keys --keyid-format=long
2. Find your key and don't use the pub ID, use the key ID you found on the sub section, also known as the subkey section which is used for signing by default.
3. Run gpg --export --armor [subKeyID] and put the subkey into GitHub's GPG Keys and not the public key itself.
4. Put the new signing key for Git usage: git config user.signingkey [subKeyID] and use git config commit.gpgsign true to automatically sign all of your commits.

If the solution doesn't work...

I have no hope for you...