Fixing “No Signature” Issue in Git Signed Commits

When verifying Git signed commits using git log --show-signature, you might encounter the message "No signature." This indicates that Git does not recognize the SSH key used for signing commits. Here’s how to resolve this by configuring Git to use the appropriate SSH key for verification.

Configuring Git to Recognize Your SSH Key

Step 1: Create an Allowed Signers File

Create an allowed signers file that lists your email and SSH public key used for signing commits.

1. Open your terminal and create a new file:

nano ~/.ssh/allowed_signers

1.Add your email and public key to the file:

<email@example.com> $(cat ~/.ssh/id_rsa.pub)

2.Save and close the file (Ctrl + X, then Y, then Enter).

Step 2: Configure Git to Use the Allowed Signers File

Tell Git to use this file for verifying signatures:

git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers

Verifying the Configuration

Now, when you run git log --show-signature, Git should recognize the signatures and display them correctly.

Example Command

To verify the signatures of your commits, use:

git log --show-signature

You should now see a confirmation that the commits are signed and valid, such as:

plaintextcommit 1234567890abcdef
gpg: Signature made ...
gpg:                using RSA key ABCDEF1234567890
gpg: Good signature from "Author Name <email@example.com>"

Conclusion

By configuring Git to recognize your SSH key for signing, you can resolve the “No signature” issue and ensure that your commits are properly authenticated and verified. This adds an extra layer of security and trust to your development workflow.

For more details on setting up and verifying Git signed commits, check out my previous blog posts: Understanding Git Signed Commits with SSH and Verifying Git Signed Commits.