git - gpg onto mac osx: error: gpg failed to sign the data

Question

I installed GPG from brew.

brew install gpg

It is gnupg2-2.0.30_2.

When I commit, I do get a error message:

You need a passphrase to unlock the secret key for
user: "Max Mustermann (mycomment) <[email protected]>"
2048-bit RSA key, ID 1111AAAA, created 2017-01-05 

error: gpg failed to sign the data
fatal: failed to write commit object

I used the command:

gpg --list-secret-keys | grep ^sec

and it gives me back:

sec   2048R/1111AAAA 2017-01-05

Then I used this command:

git config --global user.signingkey 1111AAAA

commit gives me back the same error message.

How can I solve this problem?

Stane

Also: #39495131 (Possible duplicate) – Hilaria

And #41053038 (Possible duplicates) – Hilaria

Possible duplicate of gpg failed to sign the data fatal: failed to write commit object [Git 2.10.0] – Pollinate

I had a similar issue, after a year of stable operation, although my GPG key didn't expire. All I had to do was to run gpgconf --kill gpg-agent and it started to work again. – Meninges

Why is this a Stack Overflow question (as opposed to Unix & Linux) at all? This is a command-line tool usage question, not a development question. – Ideogram

Answer 1

If you’re not getting prompted at all for a passphrase, the solution may just be to install a program to facilitate that. The most common is pinentry.

brew install pinentry-mac

So installing that and trying again may get things working. But if not, another thing to do is make sure git it using/finding the right GPG program. These days you really should be using gpg2, so if you don’t already have that installed, do this:

gpg --version

…and make sure it indicates you have GnuPG version 2+ (not version 1) installed.

If you already have GnuPG 2+ and pinentry installed, then try this:

echo "pinentry-program /usr/local/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf

…or, more robustly:

echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf

…and then try again.

And you may also need to stop gpg-agent:

gpgconf --kill gpg-agent

You don’t need to manually restart it — it will get restarted automatically when it’s needed.

Note: Some commenters mention needing to reboot after making changes — but it seems likely the only effect of that is to cause gpg-agent to be restarted. So manually killing gpg-agent as described above should be sufficient.

Equity

Installing pinentry-mac solved my issue. Thank you! – Sheepshanks

I am having the same issue, despite performing all of these steps. – Endogenous

I followed the above steps but needed a reboot before this worked – Gadfly

MacOS Mojave is the root of all evil. After I upgraded to Majave all my homebrew apps stopped working including gnupg. I recomplied them all and it started working. – Plumbic

For me restarting the gpg-agent worked so I didn't need to restart: gpgconf --kill gpg-agent – Digenesis

I had to kill gpg-agent and start it again using gpg-agent --daemon – Thissa

I got the error gpg: Sorry, no terminal at all requested - can't get input when try to use gpg --full-generate-key. If you get this error just remove the line no-tty from ~/.gnupg/gpg.conf or ~/.gnupg/options – Wailoo

I had to restart gpg-agent like @MohammadBanisaeid said – Doug

in my case, git config --global gpg.program gnupg works even though I install it via homebrew this ways: brew install gnupg2 – Burletta

I just ran a brew upgrade, which of course updated only these things: openssl, pinentry, libgcrypt, gnupg (the perfect isolated chaos to break things). It seems after the update I just needed to restart the gpg agent with: gpgconf --kill gpg-agent and then when I went to try and commit again things were fixed 🎉 – Sharolynsharon

Latest homebrew on M1 changes the bin dir, use this: echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf – Pariah

In my M1, brew install gpg already gives GnuPG 2. – Enthusiasm

It works! And if you have installed pinentry-mac with brew on latest MacOS(currently is 12.6), It will be installed at /opt/homebrew/bin/pinentry-mac – Taps

Answer 2

To anybody who is facing this issue on MacOS machines, try this:

1. brew uninstall gpg
2. brew install gpg2
3. brew install pinentry-mac (if needed)
4. gpg --full-generate-key Create a key by using an algorithm.
5. Get generated key by executing: gpg --list-keys
6. Set the key here git config --global user.signingkey <Key from your list>
7. git config --global gpg.program /usr/local/bin/gpg
8. git config --global commit.gpgsign true
9. If you want to export your Key to GitHub then: gpg --armor --export <key> and add this key to GitHub at GPG keys: https://github.com/settings/keys (with START and END line included)

If the issue still exists:

test -r ~/.bash_profile && echo 'export GPG_TTY=$(tty)' >> ~/.bash_profile

echo 'export GPG_TTY=$(tty)' >> ~/.profile

If the issue still exists:

Install https://gpgtools.org and sign the key that you used by pressing Sign from the menu bar: Key->Sign

If the issue still exists:

Go to: ‎⁨your global .gitconfig file which in my case is at: ‎⁨/Users/gent/.gitconfig And modify the .gitconfig file (please make sure Email and Name are the same with the one that you have created while generating the Key):

[user]
    email = [email protected]
    name = Gent
    signingkey = <YOURKEY>
[gpg]
    program = /usr/local/bin/gpg
[commit]
    gpsign = true
    gpgsign = true
[filter "lfs"]
    process = git-lfs filter-process
    required = true
    clean = git-lfs clean -- %f
    smudge = git-lfs smudge -- %f
[credential]
    helper = osxkeychain

p.s I took this answer from my previous answer here: gpg failed to sign the data fatal: failed to write commit object [Git 2.10.0]

Bungalow

The GPGTools is what did it for me, it seems that prompts for the passphrase and then adds it into the keychain :) – Sharolynsharon

Thanks man! Far better then the current accepted answer for me – Eristic

Signing using the GPGTools was what did it for me! Isnt there a way to sign the key using gpg cli? – Tudor

Note that "Stack Snippets" are our local JSFiddle equivalent -- they're only for JavaScript, CSS, HTML, and otherwise code that can run in a browser. Use the {} button instead of the snippet button otherwise. – Ideogram

I was missing "gpg --full-generate-key" and this is exactly what the error log was complaining about. Thank you very much for the detailed answer – Firebird

Answer 3

I had the same error message and found that my key was expired. So it might be a good idea to check your key expiration with:

gpg --list-keys

If your key is expired as well you can adjust the expiration date with:

gpg --edit-key <YOUR_KEY>

and then:

gpg> expire
...enter the new expiration date...
gpg> save

Kailyard

Many answers mention using gpg --list-keys to check if a key exists then otherwise create a new one. But nobody says to pay attention to the expiration date. There's a single character difference between [expires: YYYY-MM-DD] and [expired: YYYY-MM-DD] that can easily overlooked. – Greatgrandaunt

Answer 4

I ran brew upgrade on macOS and it broke my gpg signing in git, presumably when it updated the gpg package. I assume there's an easier way to force the gpg service to restart correctly (I assume something that was actively running broke when I upgraded the package), but my fix for this was pretty simple: Just restart your computer.

Enzymology

Indeed this just happened to me. killall gpg-agent was the process that needed a swift kick in the ... – Prism

@MikeHardy amazing ... I tried everything and this unexpected command just fixed it (got the issue after upgrading to Monterey) – Octameter

Answer 5

Install GPGSuite instead , it has GUI for generating the key.

You can see more details here

Misspeak

Answer 6

If you are still getting problems in macOS, open ~/.gitconfig and change anything below [gpg] to program = /usr/local/bin/gpg

Threadfin

Answer 7

In my case the user.signingkey was setting wrong....Copy the right signingkey the problem solved

Thant

Answer 8

If this happens to you after installing Xcode, your git binary may have been replaced. (This particular solution assumes you are managing your git install with homebrew.)

Symptoms:

1. You are not prompted for a passphrase
2. Your error message is

   error: gpg failed to sign the data
   fatal: failed to write commit object
   

3. $ git config --global gpg.program throws an error
4. You see a system git instead of one installed by homebrew:

   $ which git
   /usr/bin/git # should be /usr/local/bin/git with homebrew
   $ ls -l $(which git)
   -rwxr-xr-x  1 root  wheel  167072 Feb  6  2022 /usr/bin/git
   # should be a symbolic link with homebrew:
   # lrwxr-xr-x  1 user  admin  28 Aug 16 12:11 /usr/local/bin/git -> ../Cellar/git/2.37.2/bin/git
   $ git --version
   git version 2.32.1 (Apple Git-133)
   

In this case the solution is to install or reinstall git with homebrew.

$ brew install git
# <output>
# then restart your terminal
$ ls -l $(which git)
lrwxr-xr-x  1 user  admin  28 Aug 16 12:11 /usr/local/bin/git -> ../Cellar/git/2.37.2/bin/git
$ git --version
git version 2.37.2

Don't forget to restart your terminal.

Facsimile

Answer 9

To solve this issue without killing gpg-agent on every restart:

Check if you have multiple copies of gpg and gpg-agent:

$ which -a gpg-agent
/opt/homebrew/bin/gpg-agent
/usr/local/MacGPG2/bin/gpg-agent

$ which -a gpg
/opt/homebrew/bin/gpg
/usr/local/bin/gpg
/usr/local/bin/gpg

For me, there were some leftover binaries from old Macbook migrations installed by MacGPG2.

Removing those binaries (and symlinks) and checking again to make sure there is only one copy:

$ which -a gpg
/opt/homebrew/bin/gpg

$ which -a gpg-agent
/opt/homebrew/bin/gpg-agent

Then restart your computer one last time.

gpg should sign correctly without needing to kill anything:

$ echo "test" | gpg --clearsign
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

test
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIzBAEBCgAdFiEE1S8n.....
-----END PGP SIGNATURE-----

Eustoliaeutectic