How to understand the `gpg failed to sign the data` problem in git

README.md

Problem

You have installed GPG, then tried to commit and suddenly you see this error message after it:

error: gpg failed to sign the data
fatal: failed to write commit object

Debug

For understanding what's going on, first check what git is doing, so add GIT_TRACE=1 at the beginning of the command you used before (git commit or git rebase):

GIT_TRACE=1 git commit

With that you can see what GPG is doing: Probably you will see something like this

10:37:22.346480 run-command.c:637       trace: run_command: gpg --status-fd=2 -bsau <your GPG key>

(Check if your GPG key is correct)

Execute that gpg command again in the command line:

gpg --status-fd=2 -bsau <your GPG key>

👆🏻 With this now you could see what happened in detail!

Solutions

We can have many problems, but I list what I found:

1. It could be that the GPG key was expired: https://stackoverflow.com/a/47561300/532912

2. Another thing could be that the secret key was not set properly (In my case the message said gpg: signing failed: No secret key as it can be see in the image below). It means that is not finding the key that was set. You would need to set up the GPG key in Git (again):

   • List the secret keys available in GPG.

   gpg --list-secret-keys --keyid-format=long

   • Copy your key
   • Set your key for your user in git

   git config --global user.signingkey <your key>

3. Another popular solution that could help was shared here by @NirajanMahara: https://gist.github.com/paolocarrasco/18ca8fe6e63490ae1be23e84a7039374?permalink_comment_id=3767413#gistcomment-3767413

4. You can see in the thread of this gist other ways to find the solution to other problems. I recommend to read the Github guide for signing commits with GPG.

Hope it helps!

If you are on Windows and have used GPG4Win to manage your keys then you need to set the GPG program path.

If you look at where your gpg instance comes from mine looked like

Get-Command gpg | select Source

My gpg path was C:\Program Files (x86)\Gpg4win\..\GnuPG\bin\gpg.exe. That's quite a weird path .

But technically it is the same as "C:\Program Files (x86)\GnuPG\bin\gpg.exe"

So now set GIT to use this path:

git config --global gpg.program "C:\Program Files (x86)\GnuPG\bin\gpg.exe"

Essentially it seemed that the gpg program that was being used was different to the one being run when I used gpg on the command line.

if all of the above did not work for you

I got into a slightly different problem, everything up there ALREADY CHECKED, somehow my gpg signing stopped working - and i don't want to restart my server. After digging around i found this log

Some output of systemctl --user status gpg-agent

6월 12 00:50:55 AISRC gpg-agent[17450]: can't connect to the SCdaemon: IPC connect call failed
6월 12 00:50:55 AISRC gpg-agent[17450]: failed to unprotect the secret key: Operation cancelled
6월 12 00:50:55 AISRC gpg-agent[17450]: failed to read the secret key
6월 12 00:50:55 AISRC gpg-agent[17450]: command 'PKSIGN' failed: Operation cancelled <Pinentry>

Note that until this point, it's not about git anymore, it's about gpg and distro-specific issues.

FIXED (the root cause is pinentryscrewed things up)
Create gpg-agent.conf if you don't have one under your home dir and add the line below (pinentry-program /usr/bin/pinentry-curses)

❯ cat  ~/.gnupg/gpg-agent.conf
pinentry-program /usr/bin/pinentry-curses

Then you have to restart gpg-agent by issuing systemctl --user restart gpg-agent and you may want to log-in/out. Make sure to export GPG_TTY=$(tty) and test again. Good luck

Check my write-up here for the summary nguyenvulong/QA#25

The command

git config --global user.signingkey <your key>

helped me. I forgot to configure the key after generating.
Thanks!

Oh Gosh! You just saved my day 🙏 Thanks a lot @paolocarrasco

@NirajanMahara - Thanks buddy your solution worked for me!

It could also be due to the fact that you need to enter a password. Run ssh-add before committing.

This was effectively my issue. Somehow running the rebase with GIT_TRACE allowed it to pause and ask for a password (i.e. GIT_TRACE=1 git pull origin master --rebase) and then it all worked. This happened after my computer shut down, which probably explains why the gpg password was required again.

Now that I know GPG was causing this prompt, I followed some of these guides and setup GPG not to prompt for a password any longer.

https://gist.github.com/koshatul/2427643668d4e89c0086f297f9ed2130
https://stackoverflow.com/questions/39780452/prevent-gpg-password-prompt-on-mac
https://unixb0y.de/blog/articles/2019-01/gpg-password-macos-keychain

To test it, I ran the following to verify that it asked me for a prompt. Then, after taking the steps above it stopped asking:

echo test | gpg -e -r [email protected] | gpg -d

Follow the below url to setup signed commit https://help.github.com/en/articles/telling-git-about-your-signing-key

if still getting gpg failed to sign the data fatal: failed to write commit object

this is not issue with git ,this is with GPG follow below steps

1. gpg --version
2. echo "test" | gpg --clearsign

if it is showing:

gpg: signing failed: Inappropriate ioctl for device
gpg: [stdin]: clear-sign failed: Inappropriate ioctl for device

3. then use export GPG_TTY=$(tty)
4. then try again echo "test" | gpg --clearsign in which PGP signature is.

Output:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

test
-----BEGIN PGP SIGNATURE-----

iLMEAQEKAB0WIQS2V0SFHi18psvDbo7uFF+LP7qc1gUCYLjB2QAKCRDuFF+LP7qc
1r5LBACB1m3Lpl21379qAvVamWcn9isdgdg34t34t43t34t34t434yGQHqikxWL7A5
Ls7giKZYscb30o0rkY6I1W9MjBBW96R2pnaYsioFpsf434dfg54rfdgfdgdfgdfpaIoU3k
JKrYxR7yMjqUv0a2jE+97kh+bSuzqwIkMHyikbABI90lY+4OLw==
=UHKx
-----END PGP SIGNATURE-----

5. git config -l | grep gpg

Output:

commit.gpgsign=true
gpg.program=gpg
tag.gpgsign=true

6. apply git commit -S -m "initial commit rocketrocketrocketrocket"
7. or git config --global commit.gpgsign true

https://stackoverflow.com/questions/39494631/gpg-failed-to-sign-the-data-fatal-failed-to-write-commit-object-git-2-10-0/55993078#55993078

It worked for me. Thanks!

5. git config -l | grep gpg

it also worked for me! thank you!

It seems for every branch I have, I need to execute the export GPG_TTY=$(tty) command before committing.

Is there anyway around this?

It worked for me. Thank you!

For me the issue is always simply the fact that my vscode terminal window is too small, git needs like half a screen's height and about the width of this comment section for it to surface the GPG prompt, otherwise it errors out and tells you that:

error: gpg failed to sign the data
fatal: failed to write commit object

so I enlarge the window and voila all fixed when I run git commit again.

There's another situation:

sec   dsa3072/AAAAAAAAAAAAA 2010-05-05 [SC] [expires: 2030-05-05]
      BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
uid                 [ultimate] Author Name <[email protected]>

While GitHub documentation operates with AAAAAAAAAAAAA in sections when you need to create and register the key in GPG, git requires BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB, i.e. git config --global user.signingkey BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB, instead of git config --global user.signingkey AAAAAAAAAAAAA

Hopefully, it helps someone.

It helped me, thanks!

worked for me thank you for this!

Great! Thanks for your help!

Thank you 🙏

thank you

I was trying to solve this for 2 days! thanks!

3. then use export GPG_TTY=$(tty)

It also helped to to set it permanently in ~/.profile on Ubuntu (to do so, append export GPG_TTY=$(tty) to the ~/.profile file).

I had the same issue. The output of the command gpg --status-fd=2 -bsau was fine. It turns out my git config in the repo was the problematic. I deleted the [user] and [gpg] entries in .git/config, and then I reconfigured the pgp globally via git config --global gpg.program gpg and git config --global user.signingkey "<my signing key>" once again. Then it worked.

4. echo "test" | gpg --clearsign

this worked for me +1

I just killed the gpg-agent and started again and it worked for me

killall gpg-agent
gpg-agent daemon

thanks, @paolocarrasco

There's another situation:

sec   dsa3072/AAAAAAAAAAAAA 2010-05-05 [SC] [expires: 2030-05-05]
      BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
uid                 [ultimate] Author Name <[email protected]>

While GitHub documentation operates with AAAAAAAAAAAAA in sections when you need to create and register the key in GPG, git requires BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB, i.e. git config --global user.signingkey BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB, instead of git config --global user.signingkey AAAAAAAAAAAAA

Hopefully, it helps someone.

This solution also works for me. Thank you!

omg I just need to run export GPG_TTY=$(tty)

3. then use export GPG_TTY=$(tty)

this one worked for me as well.

3. then use export GPG_TTY=$(tty)

Thank you! it works for me!

Thank You, @paolocarrasco

It works. Thank you!

gpg: skipped "D6F50106F5C8A98B": No secret key
gpg: signing failed: No secret key
error: gpg failed to sign the data
fatal: failed to write commit object

I am getting this error since few days, I have regenerated the gpg key many times. but still I am getting this error. What should I do to get rid of this error. Please help as soon as possible.

@exostin
After struggling for hours, I finally get rid of this error.
Thanks man

@NirajanMahara lifesaver!
Your solution worked out for me.

I you're on WSL2, maybe this can help:

• Add those lines to ~/.gnupg/gpg.conf

  use-agent 
  pinentry-mode loopback
  

• Add this line to ~/.gnupg/gpg-agent.conf

  allow-loopback-pinentry