Frequently Asked Questions - Commit Signing

Commit Signing Questions

Commit stuck loading or showing a 422/500 error?

A CAC certificate without an email address association was used. Choose a certificate that displays an email address when running smimesign --list-keys. If there's no email associated with the CAC being used, fall back to signing with a GPG Key.

Commit showing as unverified?

The email address associated with the CAC does not match the GitLab commit email. Please make sure the CAC email is verified and matches the email in the user's Git configuration.

Push rejected with "Commit must be signed with a GPG key"?

You may be trying to push multiple commits, and some of them are unsigned. You will need to roll back or rebase those commits and get them signed.

Commit showing as "Signed but Unverified"?

This error usually means GitLab cannot fully validate your certificate chain.

Common causes are:

• Missing DoD root certs.
• Missing Federal Bridge certs.
• Missing enterprise roots.
• Revocation checks unavailable.

This does NOT mean signing failed. Your commit is still cryptographically signed.

"Reject Signed Commits" Push Rule Questions

Will this affect commits made through the GitLab UI?

MR commits done through the UI are not affected by this change and do not need to be signed.

Can I still commit through GitLab's Web IDE?

No.

Known Errors

Error When Signing a Commit

If you see this error, check that the DoD Certificates are installed on your machine. Refer to militarycac.com.

$ git commit -m -S 'commit message'
error: gpg failed to sign the data
fatal: failed to write commit object

If you previously signed commits using GPG, it's likely your Git user.signingkey configuration has already been set with your GPG key ID. If you've followed the directions above, you've set it as your CAC's CDS ID. You may need to remove the first configuration (i.e., the one whose value is your GPG key ID) to successfully sign commits with a CAC.

Git Push Failing

This error indicates that push is failing because it contains both signed and unsigned commits. To fix this issue:

1. Reset to the previous good push
2. Get the SHA from that push
3. Run: git reset --soft < SHA >, which will undo commits
4. Do a successful signed commit
5. Push

git Command Not Found

WinGet may install Git here C:\Users\<username>\AppData\Local\Programs\Git\cmd\git.exe.

To fix this issue:

1. Locate git.exe.

   Get-ChildItem "$env:LOCALAPPDATA\Programs" -Recurse -Filter "git.exe"

2. Add Git to the user PATH environment variable:

   $currentPath=[Environment]::GetEnvironmentVariable("Path","User")
   $newPath=$currentPath+";C:\Users\
   $env:USERNAME\AppData\Local\Programs\Git\cmd"
   [Environment]::SetEnvironmentVariable("Path",$newPath,"User")

3. Restart PowerShell.

4. Verify installation.

   git--version

smimesign Not Found

WinGet may install smimesign here: C:\Users\<username>\AppData\Local\Programs\smimesign\smimesign.exe

To fix this issue:

1. Locate smimesign.

   Get-ChildItem "$env:LOCALAPPDATA\Programs" -Recurse -Filter "smimesign.exe"

2. Add smimesign to the user PATH environment variable:

   `$currentPath=[Environment]::GetEnvironmentVariable("Path","User")
   $newPath=$currentPath+";C:\Users\
   $env:USERNAME\AppData\Local\Programs\smimesign" 
   [Environment]::SetEnvironmentVariable("Path",$newPath,"User")`

3. Restart PowerShell.

4. Verify installation.

   smimesign--version