Unable to Configure GPG Signing for Gitea Commits #14753

New Issue

GiteaMirror · 2025-11-02T11:22:04-06:00

GiteaMirror commented

2025-11-02 11:22:04 -06:00

Originally created by @eli-yip on GitHub (Jul 13, 2025).

Description

Environment

Gitea Version: 1.24.2
Deployment: Docker container
OS: Container environment

Issue Description

GPG signing for commits is not working properly. Initial commits show a warning message and signature verification fails with "BAD signature" error.

Steps to Reproduce

Setup Gitea with Docker:
- Running Gitea 1.24.2 in Docker container
- Access container: docker exec --user git -it gitea bash
Configure GPG Environment:
- Navigate to /data/gitea/home directory
- Set GNUPGHOME to /data/gitea/home/.gnupg
Generate GPG Key:
- Create master key: gpg --full-generate-key
- Export public key: gpg --armor --export
- Add exported key to Gitea via web interface

Create GPG Wrapper Script (gpg-nopinentry):

#!/bin/bash
printf "%s" "2222222" | exec gpg --homedir /data/gitea/home/.gnupg --batch --pinentry-mode loopback --no-tty --passphrase-fd 0 "$@"

Configure Git:

[gpg]
	program = "/data/gitea/home/gpg-nopinentry"

Configure Gitea (app.ini):

[repository.signing]
SIGNING_KEY = <my_key_id>
SIGNING_NAME = Gitea
SIGNING_EMAIL = gitea@xxx.com
INITIAL_COMMIT = always
CRUD_ACTIONS = pubkey, twofa, parentsigned
WIKI = never
MERGES = pubkey, twofa, basesigned, commitssigned

Test:
- Restart Gitea
- Create new repository

Expected Behavior

Commits should be properly signed with GPG and verification should succeed.

Actual Behavior

Web Interface Warning:

WARNING! Although there is a key with this ID in the database it does not verify this commit! This commit is SUSPICIOUS.

Command Line Verification (git log --show-signature):

gpg: Signature made Sun Jul 13 15:38:24 2025 CST
gpg:                using EDDSA key E9F500AACEAB7FA0xxxxxx0383D1
gpg: BAD signature from "Gitea <gitea@gitea.xxxx.com>" [ultimate]

How to solve this problem?

Gitea Version

1.24.2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Docker, 1.24.2

Database

PostgreSQL

Originally created by @eli-yip on GitHub (Jul 13, 2025). ### Description ## Environment - **Gitea Version**: 1.24.2 - **Deployment**: Docker container - **OS**: Container environment ## Issue Description GPG signing for commits is not working properly. Initial commits show a warning message and signature verification fails with "BAD signature" error. ## Steps to Reproduce 1. **Setup Gitea with Docker**: - Running Gitea 1.24.2 in Docker container - Access container: `docker exec --user git -it gitea bash` 2. **Configure GPG Environment**: - Navigate to `/data/gitea/home` directory - Set `GNUPGHOME` to `/data/gitea/home/.gnupg` 3. **Generate GPG Key**: - Create master key: `gpg --full-generate-key` - Export public key: `gpg --armor --export` - Add exported key to Gitea via web interface 4. **Create GPG Wrapper Script** (`gpg-nopinentry`): ```bash #!/bin/bash printf "%s" "2222222" | exec gpg --homedir /data/gitea/home/.gnupg --batch --pinentry-mode loopback --no-tty --passphrase-fd 0 "$@" ``` 5. **Configure Git**: ```gitconfig [gpg] program = "/data/gitea/home/gpg-nopinentry" ``` 6. **Configure Gitea** (`app.ini`): ```ini [repository.signing] SIGNING_KEY = <my_key_id> SIGNING_NAME = Gitea SIGNING_EMAIL = gitea@xxx.com INITIAL_COMMIT = always CRUD_ACTIONS = pubkey, twofa, parentsigned WIKI = never MERGES = pubkey, twofa, basesigned, commitssigned ``` 7. **Test**: - Restart Gitea - Create new repository ## Expected Behavior Commits should be properly signed with GPG and verification should succeed. ## Actual Behavior 1. **Web Interface Warning**: ``` WARNING! Although there is a key with this ID in the database it does not verify this commit! This commit is SUSPICIOUS. ``` 2. **Command Line Verification** (`git log --show-signature`): ``` gpg: Signature made Sun Jul 13 15:38:24 2025 CST gpg: using EDDSA key E9F500AACEAB7FA0xxxxxx0383D1 gpg: BAD signature from "Gitea <gitea@gitea.xxxx.com>" [ultimate] ``` How to solve this problem? ### Gitea Version 1.24.2 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Docker, 1.24.2 ### Database PostgreSQL

GiteaMirror added the topic/commit-signing type/bug labels 2025-11-02 11:22:04 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14753