paolocarrasco/README.md

Last active November 5, 2024 20:08

Star () You must be signed in to star a gist
Fork () You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/paolocarrasco/18ca8fe6e63490ae1be23e84a7039374.js"></script>
Save paolocarrasco/18ca8fe6e63490ae1be23e84a7039374 to your computer and use it in GitHub Desktop.

Download ZIP

How to understand the `gpg failed to sign the data` problem in git

Raw

README.md

Problem

You have installed GPG, then tried to commit and suddenly you see this error message after it:

error: gpg failed to sign the data
fatal: failed to write commit object

Debug

For understanding what's going on, first check what git is doing, so add GIT_TRACE=1 at the beginning of the command you used before (git commit or git rebase):

GIT_TRACE=1 git commit

With that you can see what GPG is doing: Probably you will see something like this

10:37:22.346480 run-command.c:637       trace: run_command: gpg --status-fd=2 -bsau <your GPG key>

(Check if your GPG key is correct)

Execute that gpg command again in the command line:

gpg --status-fd=2 -bsau <your GPG key>

👆🏻 With this now you could see what happened in detail!

Solutions

We can have many problems, but I list what I found:

It could be that the GPG key was expired: https://stackoverflow.com/a/47561300/532912
Another thing could be that the secret key was not set properly (In my case the message said gpg: signing failed: No secret key as it can be see in the image below). It means that is not finding the key that was set. You would need to set up the GPG key in Git (again):
- List the secret keys available in GPG.
```
gpg --list-secret-keys --keyid-format=long
```
- Copy your key
- Set your key for your user in git
```
git config --global user.signingkey <your key>
```
Another popular solution that could help was shared here by @NirajanMahara: https://gist.github.com/paolocarrasco/18ca8fe6e63490ae1be23e84a7039374?permalink_comment_id=3767413#gistcomment-3767413
You can see in the thread of this gist other ways to find the solution to other problems. I recommend to read the Github guide for signing commits with GPG.

Hope it helps!

gauravk-io commented Apr 4, 2023 •

edited

Loading

I was getting the error

gpg: skipped "29D277CEFE65F74E": No secret key
gpg: signing failed: No secret key
error: gpg failed to sign the data
fatal: failed to write commit object

I just need to set the

gpg.program="C:\Program Files (x86)\GnuPG\bin\gpg.exe"

gpg.program=gpg

THANKYOU @victorjatoba

Riessarius commented Apr 9, 2023

This exactly solved my problem. Great thanks! @victorjatoba

renjujv commented Apr 24, 2023

Thanks @paolocarrasco

pro-akim commented May 2, 2023

Thanks @paolocarrasco, you are awesome

igorsobot commented May 8, 2023

I just killed the gpg-agent and started again and it worked for me
killall gpg-agent
gpg-agent daemon

Yes, sometimes pinentry-mac update brakes gpg-agent

T410 commented May 12, 2023

Additionally, if you are using a mac and you are experiencing an issue, try step number 8: https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key?platform=mac

$ brew install pinentry-mac
$ echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf
$ killall gpg-agent

basically, it allows/forces your device to ask the password of the key

DejavuMoe commented May 14, 2023

Super useful, thank you very much!

ghdcksgml1 commented May 30, 2023

Thanks :) @T410

klubi commented Jun 6, 2023

I'm running into similar issue, but It may be a layer deeper.
When I run gpg --status-fd=2 -bsau ... I get

[GNUPG:] PINENTRY_LAUNCHED 106 curses 1.1.0 - - -
gpg: signing failed: Inappropriate ioctl for device
[GNUPG:] FAILURE sign 83918950
gpg: signing failed: Inappropriate ioctl for device

I'm running that in jenkins, and I assume Jenkins is awaiting for passphrase input, but I can't seem to figure out how to sent it to it...

ferdogan-nex commented Jun 12, 2023 •

edited

Loading

This one worked for me. Thanks.

update: I just realised it didn't work.

thyarles commented Jun 12, 2023

This one worked for me. Thanks.

Which one?

klubi commented Jun 12, 2023

I'm running into similar issue, but It may be a layer deeper. When I run gpg --status-fd=2 -bsau ... I get
[GNUPG:] PINENTRY_LAUNCHED 106 curses 1.1.0 - - -
gpg: signing failed: Inappropriate ioctl for device
[GNUPG:] FAILURE sign 83918950
gpg: signing failed: Inappropriate ioctl for device
I'm running that in jenkins, and I assume Jenkins is awaiting for passphrase input, but I can't seem to figure out how to sent it to it...

In case anyone runs into same issue, I ended up with below steps to import gpg key to Jenkins and use it to sign commits.

def call(String key_secret, String key_pass_secret, String key_id_secret, String key_grip_secret) {

    withCredentials([file(credentialsId: key_secret, variable: 'GPG_KEY'), 
    string(credentialsId: key_pass_secret, variable: 'GPG_KEY_PASS'),
    string(credentialsId: key_id_secret, variable: 'GPG_KEY_ID'),
    string(credentialsId: key_grip_secret, variable: 'GPG_KEY_GRIP')]) {
        sh """
            gpg --batch --passphrase $GPG_KEY_PASS --import $GPG_KEY
            echo allow-preset-passphrase > /root/.gnupg/gpg-agent.conf
            gpgconf --kill gpg-agent
            gpg-connect-agent -v
            \$(gpgconf --list-dirs libexecdir)/gpg-preset-passphrase --preset --passphrase $GPG_KEY_PASS $GPG_KEY_GRIP
            git config --global commit.gpgsign true
            git config --global user.signingkey $GPG_KEY_ID
            git config --global user.email "<REDACTED>"
            git config --global user.name "<REDACTED>”
        """
        }
}

to get key_grip run gpg —with-keygrip -K

All those shenanigans are caused by lack of tty in Jenkins thus there is no way to interactively input passphrase, so gpg-agent has to receive it as preset.
Killing and connecting back to agent is meant to solve two issues: updates to config, and race condition between agent startup and trying to exec proceeding command.

ferdogan-nex commented Jun 13, 2023

This one worked for me. Thanks.

Which one?

Never mind, it actually didn't work. I still have the same issue.

ferdogan-nex commented Jun 13, 2023

I got my issue solved. It was due to git version. Apparently git needs to be above 2.34 for code signing using SSH.

empeje commented Jun 22, 2023

5. then use export GPG_TTY=$(tty)

It also helped to to set it permanently in ~/.profile on Ubuntu (to do so, append export GPG_TTY=$(tty) to the ~/.profile file).

This save my life 🔥

gregorywaynepower commented Jul 3, 2023

On Windows 10 machine, I aligned my Local Git instance's username and email to my Github username and email.

The linchpin was taking the second line of gpg --list-secret-keys --keyid-format=LONG (the one below sec) and put that longer code as my user.signingkey for my git config.

wushingmushine commented Jul 4, 2023 •

edited

Loading

I haven't seen this one yet in thread so in case anyone else encounters it in a small terminal window:

With the same initial error and trace log I ran gpg --status-fd=2 -bsau <your GPG key> but it hung indefinitely with no output.
So I tried echo "test" | gpg --clearsign and got this error:

> echo "test" | gpg --clearsign                                          
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

test
gpg: signing failed: Screen or window too small
gpg: [stdin]: clear-sign failed: Screen or window too small

So turns out you can get this error if your terminal window is too small because the key passphrase box cannot pop up

Thanks @paolocarrasco and @truemiller for the pointers!

ferpieklo commented Jul 6, 2023

I'm on Windows using the terminal and Gpg4Win (instead of Git Bash), and this helped me solve the gpg: signing failed: No secret key issue.

Make sure that git config gpg.program points to the gpg.exe file from the package by doing the following:

Run where.exe gpg.
If the output returns several executables, locate the one from Gpg4Win (by default, the path is C:\Program FIles (x86)\GnuPG\bin\gpg.exe.
Run git config --global gpg.program <path/to/gpg/from/Gpg4Win>

(source here)

psavarmattas commented Aug 4, 2023 •

edited

Loading

Thanks so much for this @NirajanMahara . This worked like a charm!

joespinelli7 commented Aug 23, 2023

Thank you! Guided me perfectly through my issue and resolved within minutes :)

Ahmedntc commented Aug 28, 2023

I you're on WSL2, maybe this can help:
Add those lines to ~/.gnupg/gpg.conf
use-agent 
pinentry-mode loopback
Add this line to ~/.gnupg/gpg-agent.conf
allow-loopback-pinentry

Tried pretty much everything and this was what worked for me, thank you!

meerilahi commented Sep 1, 2023

Thanks
@gauravk-io

gbdubs commented Sep 3, 2023

Thank you!

OverRevvv commented Sep 12, 2023

Thank you @gauravk-io , I did what you did and resolved the error.

luiguip commented Sep 20, 2023

I you're on WSL2, maybe this can help:

* Add those lines to `~/.gnupg/gpg.conf`
  ```
  use-agent 
  pinentry-mode loopback
  ```

* Add this line to `~/.gnupg/gpg-agent.conf`
  ```
  allow-loopback-pinentry
  ```

Thanks, worked on WSL2.

wlopez30 commented Sep 30, 2023

echo "test" | gpg --clearsign

I haven't seen this one yet in thread so in case anyone else encounters it in a small terminal window:

With the same initial error and trace log I ran gpg --status-fd=2 -bsau <your GPG key> but it hung indefinitely with no output. So I tried echo "test" | gpg --clearsign and got this error:
> echo "test" | gpg --clearsign                                          
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

test
gpg: signing failed: Screen or window too small
gpg: [stdin]: clear-sign failed: Screen or window too small
So turns out you can get this error if your terminal window is too small because the key passphrase box cannot pop up

Thanks @paolocarrasco and @truemiller for the pointers!

Yup. This was it for me.
Thank you!

Carlos-vargs commented Oct 9, 2023

omg I just need to run export GPG_TTY=$(tty)

then use export GPG_TTY=$(tty)

I tried everything and found that comment, you saved me bro

rosangelysreyes commented Oct 10, 2023

Thank you! It worked for me following each step ❤️

lehaiquantb commented Oct 16, 2023

On MacOS, I have to install pinentry-mac to enter passphrase

brew install pinentry-mac
echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf
killall gpg-agent

after-ephemera commented Oct 16, 2023

Thank you for this!

paolocarrasco/README.md

Problem

Debug

Solutions

gauravk-io commented Apr 4, 2023 • edited Loading

Riessarius commented Apr 9, 2023

renjujv commented Apr 24, 2023

pro-akim commented May 2, 2023

igorsobot commented May 8, 2023

T410 commented May 12, 2023

DejavuMoe commented May 14, 2023

ghdcksgml1 commented May 30, 2023

klubi commented Jun 6, 2023

ferdogan-nex commented Jun 12, 2023 • edited Loading

thyarles commented Jun 12, 2023

klubi commented Jun 12, 2023

ferdogan-nex commented Jun 13, 2023

ferdogan-nex commented Jun 13, 2023

empeje commented Jun 22, 2023

gregorywaynepower commented Jul 3, 2023

wushingmushine commented Jul 4, 2023 • edited Loading

ferpieklo commented Jul 6, 2023

psavarmattas commented Aug 4, 2023 • edited Loading

joespinelli7 commented Aug 23, 2023

Ahmedntc commented Aug 28, 2023

meerilahi commented Sep 1, 2023

gbdubs commented Sep 3, 2023

OverRevvv commented Sep 12, 2023

Thank you @gauravk-io , I did what you did and resolved the error.

luiguip commented Sep 20, 2023

wlopez30 commented Sep 30, 2023

Carlos-vargs commented Oct 9, 2023

rosangelysreyes commented Oct 10, 2023

lehaiquantb commented Oct 16, 2023

after-ephemera commented Oct 16, 2023

gauravk-io commented Apr 4, 2023 •

edited

Loading

ferdogan-nex commented Jun 12, 2023 •

edited

Loading

wushingmushine commented Jul 4, 2023 •

edited

Loading

psavarmattas commented Aug 4, 2023 •

edited

Loading