gitgithubgit-commitgpg-signature

Unverified GPG signature committed by GitHub, why?

I was working on a C++ project in CLion. I came across a Git Log message:

Commit Log

My question:

When I make changes on a repository directly from GitHub, why does it say Unverified GPG signature in the Git Log despite having a Verified mark on GitHub?

GitHub Verified Mark

Edit 1: I have verified and ultimately trusted public and private GPG keys on my machine as well as on GitHub:

rohan@Genesis:~$ gpg --list-keys
/home/rohan/.gnupg/pubring.kbx
------------------------------
pub   rsa3072 2021-07-10 [SC]
      xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
uid           [ultimate] Rohan Bari (Rohan Bari's GPG key created on Tesla's birthday.) <rohanbari4@gmail.com>
sub   rsa3072 2021-07-10 [E]
Solution

  • From a quick reading, to me it seems that to verify the commit locally (like in your git UI picture) you need the public key of the pair that has signed the commit. Since it was signed by Github's key (when clicking on the "Verified" you get a pop-up with This commit was created on GitHub.com and signed with GitHub's verified signature. or something similar) and not yours, thus you cannot verify it since you do not have the public key installed.

    You can see the same issue when another user wanted to try to verify other people's commits in Github: How to locally verify signed commits by other people?

    The Github status refers to Github's ability to determine the signature from configured keys https://docs.github.com/en/authentication/managing-commit-signature-verification/displaying-verification-statuses-for-all-of-your-commits

    By default commits and tags are marked "Verified" if they are signed with a GPG, SSH, or S/MIME key that was successfully verified.

    As @JoachimSauer already proposed, you should add Github's key to be able to verify the commits https://stackoverflow.com/a/60482908/18973005