If you enable GPG verification, GitHub Codespaces automatically signs your commits in codespaces that you create from selected repositories. For more information, see "Managing GPG verification for GitHub Codespaces."
Once you enable GPG verification, it will automatically take effect in any new codespaces you create from the relevant repositories. To have GPG verification take effect in an existing active codespace, you will need to stop and restart the codespace. For more information, see "Stopping and starting a codespace."
If GitHub Codespaces fails to sign a commit, you may see an error like the following.
git commit -m 'Initial commit' error: gpg failed to sign the data fatal: failed to write commit object
You may encounter this error if:
- You have disabled GPG verification, and are trying to make a regular, unsigned commit in an existing codespace.
- You have enabled GPG verification, but have overridden the Git configuration required for GitHub Codespaces to sign your commits, for example by linking GitHub Codespaces with a dotfiles repository that contains Git configuration files.
When you enable GPG verification, GitHub Codespaces signs all the commits you make in codespaces by default. It does this by setting the
commit.gpgsign Git configuration value to
If you have disabled GPG verification, and are working in an existing codespace, then this value will still be set to
true. This means that GitHub Codespaces will try to sign your commits, but will be unable to do so, because you have disabled the GPG verification setting.
To keep making regular, unsigned commits in your codespace, reset
commit.gpgsign to the default value of
false by entering the following command in the terminal.
git config --unset commit.gpgsign
To check that the value has been correctly removed from your configuration, you can enter
git config --list. You should not see a value for
commit.gpgsign in the list.
To automatically sign your commits, GitHub Codespaces sets certain Git configuration values in your codespace. If you override the values set by GitHub Codespaces, you may be unable to sign your commits.
You may be inadvertently overriding these values if you have linked GitHub Codespaces with a dotfiles repository that contains Git configuration files. For more information about using dotfiles with GitHub Codespaces, see "Personalizing GitHub Codespaces for your account."
To sign your commits with GPG, GitHub Codespaces automatically sets the following Git configuration values at the system level.
|Configuration setting||Required value|
|Must match the full name set on your GitHub profile|
|Must be set to |
|Must be set to |
To check that these values are set correctly in a codespace, you can use the
git config --list --show-origin command. Because GitHub Codespaces sets this configuration at the system level, the required configuration settings should come from
git config --list --show-origin file:/usr/local/etc/gitconfig credential.helper=/.codespaces/bin/gitcredential_github.sh file:/usr/local/etc/gitconfig user.name=Mona Lisa file:/usr/local/etc/gitconfig gpg.program=/.codespaces/bin/gh-gpgsign
In addition to the values listed above, you may run into errors if the dotfiles used in your codespaces contain any of the following values.
user.signingkeyGit config value
commit.gpgsignGit config value
- A manually set
If you want to keep automatic GPG verification for GitHub Codespaces enabled, you will need to remove any conflicting configuration from the dotfiles used in your codespaces.
For example, if the global
.gitconfig file on your local machine contains a
gpg.program value, and you have pushed this file to a dotfiles repository that is linked with GitHub Codespaces, then you may want to remove
gpg.program from this file and set it at the system level on your local machine instead.
Note: Any changes to your dotfiles repository will apply to new codespaces you create, but not to your existing codespaces.
On your local machine, open a terminal.
To remove the conflicting value from
C:\Users\YOUR-USER\.gitconfig(Windows), use the
git config --global --unsetcommand.
git config --global --unset gpg.program
Push the change to your dotfiles repository on GitHub.
Optionally, to keep your local configuration, set the value again in a Git configuration file that you do not push to your dotfiles repository.
For example, you can use the
--systemflag to set the configuration in the system-level file at
PATHis the directory in which Git is installed on your system.
git config --system gpg.program gpg2
Alternatively, if your dotfiles repository contains an installation script in a recognized file such as
install.sh, you can use the
$CODESPACES environment variable to add conditional logic, such as only setting
gpg.program when you are not in a codespace. In the following example,
-z "$CODESPACES" returns
true if you are not in a codespace.
if [ -z "$CODESPACES" ]; then git config --global gpg.program gpg2 fi