21

Currently, I use 2 emails, (Personal + Company) with one SSH key to log in to GitHub. But I use the same GPG key for signing. Both are verified on my GitHub Email Settings page.

On the first one (personal), no issue, when I do a commit it appears as Verified. On the second one (company), the commits appear as Unverified in GitHub with the following warning message:

The email in this signature doesn’t match the committer email.

$ gpg --list-secret-keys --keyid-format LONG

...
sec   rsa4096/MY_GPG_KEY_ID 2020-05-19 [SC] [expires: 2022-05-19]
...
uid    [ultimate] Furkan (Company key) <second_email@test.com>
uid    [ultimate] Furkan <first_email@test.com>

In the repository:

$ git log --show-signature

...
gpg: Good signature from "Furkan (Company key) <second_email@test.com>" [ultimate]
gpg:                 aka "Furkan <first_email@test.com>" [ultimate]
Author: MyGitHubNickname <second_email@test.com>
...

Local config settings:

$ git config --local --list

...
user.name=Furkan
user.email=second_email@test.com

Global config settings:

$ git config --global --list

...
user.name=MyGitHubNickname
user.email=second_email@test.com
user.signingkey=MY_40_CHARACTER_SIGNING_KEY

But did not work:

$ git commit -S --amend --reset-author
$ git push --force

I see MY_GPG_KEY_ID key at the bottom of this popup, exactly the same.

picture

I followed Troubleshooting commit signature verification and Using a verified email address in your GPG key guides as described in GitHub Docs, but still did not fix the problem.

Dentrax
  • 574
  • 8
  • 22
  • In your GitHub user settings > "SSH and GPG keys", do you see both email addressees listed for the key in question? – qitianshi Oct 12 '21 at 11:06
  • 1
    I could not see both email addresses in the GPG keys, there are two same mails, but it set to my primary mail. I exported the my secondary mail's gpg public key: `gpg --output public.pgp --armor --export name@mail` But GitHub says: "Key already exists and Public key already exists " – Dentrax Oct 13 '21 at 08:12
  • this is more like an answer than a question. ;) – Milad Faridnia Jun 26 '23 at 15:11

3 Answers3

26

Everything you did so far is correct; you're just missing the final step which is to update GitHub's copy of your public key.

You need to regenerate your public key (gpg --armor --export KEY_ID), then, in your GitHub user settings > "SSH and GPG keys", you need to delete the original key and upload the regenerated public key.

This is what it should end up looking like. Commits signed with any of the listed addresses will now show as Verified.

GPG key with two associated email addresses

qitianshi
  • 619
  • 8
  • 19
  • 6
    If you've previously uploaded this same key but with only one address, for some reason GitHub won't allow you to upload your updated key if you don't delete the original first ("Key already exists and Public key already exists"). – qitianshi Oct 14 '21 at 02:16
  • "**_delete the original key_**" solved it for me – GHOST-34 Nov 10 '22 at 21:10
3

In my case there was a discrepancy between committer and author. GitHub shows the author by default, but the committer was set to something auto-generated.

You can check with git log --format=full

RickDG
  • 94
  • 4
  • As per your git command, I have noted my commits are using some random generated email as Author and Commit. After updating my Email in Menu Git -> Options, now I am able to see verified sign for my commit, and for the first time, It didnt ask password for commit. Dont know how it happened. If any one know how commit verified without password is possible? – Pranesh Janarthanan Jun 21 '21 at 09:03
  • 1
    Same. Check current email using `git config user.email` and, if incorrect, set with `git config user.email "newemail@example.com"` or `git config --global user.email "newemail@example.com"`. – nicolaus-hee Dec 17 '21 at 17:28
1

As I have just discovered that you also need to be aware that if you have checked "Keep my email addresses private" in your settings and your trying to use just GPG key, that it will keep posting "unverified commit" as your email never matches. I spent days having my head done on in this, trying to figure it out, hunting forums and searches

My guess is if you use "Keep my email addresses private" you need to see what the "hidden email address" you are given is, and include it in your GPG Key "email" in your key

there is NOWHERE that mentions this! (I would have added in comments but, not enough points, but it is another answer!)

Jason Oppermann
  • 11
  • 2
  • I Didn't try the "mystery email address" in the key but i DID use `git config user.email` and that's how I discovered the email mismatching, as soon as I removed "Keep my email addresses private" it all suddenly worked. – Jason Oppermann Jun 07 '23 at 02:51