Gitea doesn't recognize my GPG key #1003

New Issue

GiteaMirror · 2025-11-02T03:44:53-06:00

GiteaMirror commented

2025-11-02 03:44:53 -06:00

Originally created by @sondr3 on GitHub (Aug 25, 2017).

Gitea version (or commit ref): 1.2-rc1
Git version: 2.1.2
Operating system: Debian 8.9
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (https://try.gitea.io/sondr3/test1)
- No
- Not relevant
Log gist:

Description

I've added my GPG key to a 1.2-rc1 version of Gitea that I'm running, and it says that it can't find any key matching my email for that address. Github recognizes it and supports it just fine, but Gitea for some reason doesn't. I can't recall what settings I used to generate the GPG key anymore, it's been a while since I created it.

Screenshots

Originally created by @sondr3 on GitHub (Aug 25, 2017).  - Gitea version (or commit ref): 1.2-rc1 - Git version: 2.1.2 - Operating system: Debian 8.9 - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (https://try.gitea.io/sondr3/test1) - [ ] No - [ ] Not relevant - Log gist: ## Description I've added my GPG key to a 1.2-rc1 version of Gitea that I'm running, and it says that it can't find any key matching my email for that address. Github recognizes it and supports it just fine, but Gitea for some reason doesn't. I can't recall what settings I used to generate the GPG key anymore, it's been a while since I created it. ## Screenshots <img width="651" alt="screen shot 2017-08-26 at 00 39 52" src="https://user-images.githubusercontent.com/2280539/29735270-0d246530-89f8-11e7-8799-c7b08e75af8e.png"> <img width="467" alt="screen shot 2017-08-26 at 00 40 07" src="https://user-images.githubusercontent.com/2280539/29735269-0d23056e-89f8-11e7-8e49-cbea874217f8.png">

GiteaMirror added the type/question label 2025-11-02 03:44:53 -06:00

GiteaMirror closed this issue

2025-11-02 03:44:53 -06:00

GiteaMirror commented

2025-11-02 03:44:54 -06:00

@sapk commented on GitHub (Aug 27, 2017):

It seems that it's not the key you used to sign the commit. When I clone your repo example on try.gitea.io, I get that you sign with RSA D78D17BB14716F42

@sapk commented on GitHub (Aug 27, 2017): It seems that it's not the key you used to sign the commit. When I clone your repo example on try.gitea.io, I get that you sign with `RSA D78D17BB14716F42`

GiteaMirror commented

2025-11-02 03:44:54 -06:00

@sapk commented on GitHub (Aug 27, 2017):

To verify that :

git clone https://try.gitea.io/sondr3/test1.git
cd test1
git log --show-signature

@sapk commented on GitHub (Aug 27, 2017): To verify that : ```bash git clone https://try.gitea.io/sondr3/test1.git cd test1 git log --show-signature ```

GiteaMirror commented

2025-11-02 03:44:54 -06:00

@sondr3 commented on GitHub (Aug 27, 2017):

Yeah, this was my fault. Apparently I had exported a subkey and not the actual GPG key itself, so I was using the wrong one. My bad, thanks for pointing it out, it works fine now that I'm using the correct one.

@sondr3 commented on GitHub (Aug 27, 2017): Yeah, this was my fault. Apparently I had exported a subkey and not the actual GPG key itself, so I was using the wrong one. My bad, thanks for pointing it out, it works fine now that I'm using the correct one.

GiteaMirror commented

2025-11-02 03:44:55 -06:00

@sapk commented on GitHub (Aug 27, 2017):

Glad to here that. enjoy 😄

@sapk commented on GitHub (Aug 27, 2017): Glad to here that. enjoy :smile:

GiteaMirror commented

2025-11-02 03:44:55 -06:00

@Mikaela commented on GitHub (Jun 6, 2018):

I was having this issue with key 29104A46C5615BF978A083F20C207F07B2F32B67 until I removed it from Gitea and added again with gpg --export-options export-minimal --export 29104A46C5615BF978A083F20C207F07B2F32B67.

Gitea kept saying No known key found for this signature in database and the person running the Gitea instance thought that it may be a problem with amount of subkeys that I have.

@Mikaela commented on GitHub (Jun 6, 2018): I was having this issue with key `29104A46C5615BF978A083F20C207F07B2F32B67` until I removed it from Gitea and added again with `gpg --export-options export-minimal --export 29104A46C5615BF978A083F20C207F07B2F32B67`. Gitea kept saying *No known key found for this signature in database* and the person running the Gitea instance thought that it may be a problem with amount of subkeys that I have.

GiteaMirror commented

2025-11-02 03:44:55 -06:00

@lunny commented on GitHub (Jun 6, 2018):

@Mikaela Please fire another issue since your problem is different from this one.

@lunny commented on GitHub (Jun 6, 2018): @Mikaela Please fire another issue since your problem is different from this one.

GiteaMirror commented

2025-11-02 03:44:55 -06:00

@Mikaela commented on GitHub (Jun 6, 2018):

@lunny I don't know what subject to use or anything and I managed to get it workarounded. As the symptom is the same as in the subject of this one, I think this should be reopened in case you can reproduce the issue.

@Mikaela commented on GitHub (Jun 6, 2018): @lunny I don't know what subject to use or anything and I managed to get it workarounded. As the symptom is the same as in the subject of this one, I think this should be reopened in case you can reproduce the issue.

GiteaMirror commented

2025-11-02 03:44:55 -06:00

@Panzer1119 commented on GitHub (Mar 15, 2019):

I have a similiar/the same problem, but when i imported the public gpg key on my pc it shows the signature is verified (git log --show-signature).
But when i use the exact same String (public gpg key in ascii form) in my Gitea Account, it does not recognize the signature of commits.
(Its a 2048 Bit rsa gpg key, maybe thats a problem? Because my 4096 Bit rsa gpg key does work)
The fingerprints of the key shown by git log --show-signature and on Gitea are also the same :/

@Panzer1119 commented on GitHub (Mar 15, 2019): I have a similiar/the same problem, but when i imported the public gpg key on my pc it shows the signature is verified (`git log --show-signature`). But when i use the exact same String (public gpg key in ascii form) in my Gitea Account, it does not recognize the signature of commits. (Its a 2048 Bit rsa gpg key, maybe thats a problem? Because my 4096 Bit rsa gpg key does work) The fingerprints of the key shown by `git log --show-signature` and on Gitea are also the same :/

GiteaMirror commented

2025-11-02 03:44:56 -06:00

@Panzer1119 commented on GitHub (Mar 15, 2019):

Hmmm i created a new keypair (2048 Bits rsa) and signed it via my ios app (where i had problem with signed commits) and it did not work.
Then i importet this keypair on my pc and signed a new commit from the pc.
Now Gitea recognizes the key.

But in both cases my local git recognized both signatures made from the ios app and the pc...

@Panzer1119 commented on GitHub (Mar 15, 2019): Hmmm i created a new keypair (2048 Bits rsa) and signed it via my ios app (where i had problem with signed commits) and it did not work. Then i importet this keypair on my pc and signed a new commit from the pc. Now Gitea recognizes the key. But in both cases my local git recognized both signatures made from the ios app and the pc...

GiteaMirror commented

2025-11-02 03:44:56 -06:00

@lunny commented on GitHub (Mar 15, 2019):

@Panzer1119 any log on your backend?

@lunny commented on GitHub (Mar 15, 2019): @Panzer1119 any log on your backend?

GiteaMirror commented

2025-11-02 03:44:56 -06:00

@Panzer1119 commented on GitHub (Mar 15, 2019):

What kinda log? I believe the App is creating the signature different than the computer?

@Panzer1119 commented on GitHub (Mar 15, 2019): What kinda log? I believe the App is creating the signature different than the computer?

GiteaMirror commented

2025-11-02 03:44:56 -06:00

@pedroapero commented on GitHub (Apr 1, 2019):

I'm using gnupg 1.4.18 from Debian with a 4096Bits key, I am not able to confirm signed tags either (open padlock with "not a signed commit").
My key pair (master + one subkey) was imported correctly on my account.
Using git verify-tag I can verify that the tag is signed with one of the keys displayed on my settings page. I can't make Gitea (v1.7.3) display the tag's signature key ID though.

Edit: after some testing, the problem appears with tags only, the padlock is green for commits.

@pedroapero commented on GitHub (Apr 1, 2019): I'm using gnupg 1.4.18 from Debian with a 4096Bits key, I am not able to confirm signed tags either (open padlock with "not a signed commit"). My key pair (master + one subkey) was imported correctly on my account. Using `git verify-tag` I can verify that the tag is signed with one of the keys displayed on my settings page. I can't make Gitea (v1.7.3) display the tag's signature key ID though. Edit: after some testing, the problem appears with tags only, the padlock is green for commits.

GiteaMirror commented

2025-11-02 03:44:56 -06:00

@georgeowell commented on GitHub (Apr 7, 2020):

I am having this same problem but for commits. Can verify the commits locally all good, all using the same key.

But in Gitea, they are now marked as
WARNING! Although there is a key with this ID in the database it does not verify this commit! This commit is SUSPICIOUS. GPG Key ID: EDE939629F5C1A6A

https://git.autonomic.zone/kawaiipunk/walkaway-wiki/commits/branch/master

As far as I know, nothing has changed in my configs. Signing is working all good on Gitlab and Github. I just can't see any problems except at the Gitea end of things.

My .gitconfig:

[user]
	name = kawaiipunk
	email = [redacted this for obscurity but it matches all good]
	signingkey = DAFA9CA84CFD48F5FCEACEAAEDE939629F5C1A6A
[push]
	default = simple
[commit]
	gpgsign = true
[gpg]
	program = gpg
[tag]
	forceSignAnnotated = true

I tried re-adding my GPG pub key to the Gitea interface in a few different ways but same story.

@georgeowell commented on GitHub (Apr 7, 2020): I am having this same problem but for commits. Can verify the commits locally all good, all using the same key. But in Gitea, they are now marked as ` WARNING! Although there is a key with this ID in the database it does not verify this commit! This commit is SUSPICIOUS. GPG Key ID: EDE939629F5C1A6A` https://git.autonomic.zone/kawaiipunk/walkaway-wiki/commits/branch/master As far as I know, nothing has changed in my configs. Signing is working all good on Gitlab and Github. I just can't see any problems except at the Gitea end of things. My `.gitconfig`: ``` [user] name = kawaiipunk email = [redacted this for obscurity but it matches all good] signingkey = DAFA9CA84CFD48F5FCEACEAAEDE939629F5C1A6A [push] default = simple [commit] gpgsign = true [gpg] program = gpg [tag] forceSignAnnotated = true ``` I tried re-adding my GPG pub key to the Gitea interface in a few different ways but same story.

GiteaMirror commented

2025-11-02 03:44:57 -06:00

@zeripath commented on GitHub (Apr 7, 2020):

@georgeowell Please don't write on closed issues - comments are very likely to be missed.

This is a different problem to the OPs issue - although it fits with the previous person who also wrote on an already closed issue. My initial suspicion is that you are hitting #10420 but without knowing your version I cannot confirm.

We need to know what version of Gitea you are running.

@zeripath commented on GitHub (Apr 7, 2020): @georgeowell Please don't write on closed issues - comments are very likely to be missed. This is a different problem to the OPs issue - although it fits with the previous person who also wrote on an already closed issue. My initial suspicion is that you are hitting #10420 but without knowing your version I cannot confirm. We need to know what version of Gitea you are running.

GiteaMirror referenced this issue

2025-11-02 11:52:45 -06:00

[PR #1005] [MERGED] Fix some links. #15706

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#1003