9

I'm trying to enable commit signing on OS X Mojave.

git commit -S -am "Test"

The error is:

error: gpg failed to sign the data
fatal: failed to write commit object

What I tried:

  • gpg works fine (see below), did not install gpg1 or gpg2
  • Installed GPG KeyChain and added a new key (even added a separate sign-only subkey whithin)
  • Installed pinentry
  • gpg2 --clearsign works fine (generates a new .asc file for files, outputs text for plain text)

Questions I looked into and tried every option:

What am I doing wrong?

Alex Buznik
  • 608
  • 1
  • 5
  • 25
  • if you are looking to get added to a repo instead of init git-crypt in your repo, youll need to let someone who already has access to the encrypted files to add your public key to the `/.git-crypt/...` part of the repo – mewc May 06 '20 at 03:22
  • Thanks @mewc, but that was not the case, see my own answer below – Alex Buznik May 06 '20 at 10:20
  • Cool, more of an fyi for the next person. Didnt feel it deserved its own answer. – mewc May 07 '20 at 00:59

4 Answers4

46

I also had this problem. I found a good solution. Just try to sign a file before you commit.

$ touch a.txt
$ gpg --sign a.txt

Then, the OS will let you input the password. If this step is OK, now you can commit by signing correctly.

Wasi
  • 1,313
  • 3
  • 17
  • 30
mkckr0
  • 461
  • 4
  • 4
18

I just added the key ID to the global config

list all keys:

gpg --list-keys

Select the one you added to github and set it.

git config --global user.signingkey [public key ID]
MewX
  • 4,053
  • 1
  • 28
  • 37
Zacbe Gonzalez
  • 181
  • 1
  • 6
4

Heh, of course, right after I posted this question, I found the solution.

So my problem was that I followed this doc: https://help.github.com/en/articles/telling-git-about-your-signing-key

And set up both GPG and smimesign, when I have Git < 2.19 and no proper X.509 keys.

So I just removed the part with smimesign from global ~/.gitconfig

Alex Buznik
  • 608
  • 1
  • 5
  • 25
2

Try with echo "foobar" | gpg --clearsign. It should ask for your key's passphrase and return the signature. If instead you see the following error message:

error: gpg failed to sign the data
fatal: failed to write commit object

You might want to try running export GPG_TTY=$(tty). If after testing again you're prompted for the password and it works, run this everytime on startup, adding it to ~/.bashrc, which is actually required according to gpg-agent's documentation, as mentioned in this dev.gnupg thread and which you can verify with man gpg-agent.

I also found this gitHub gist very useful.

LucasFA
  • 31
  • 1