error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification

`git log --show-signature` prints the same line and then "No signature" for the commit, which looks like the commit is unsigned — it is not.

What it means

The commit carries an SSH signature (`gpg.format ssh`), and Git verifies those with `ssh-keygen -Y verify` against an "allowed signers" file that maps identities (emails) to trusted public keys. No such file is configured, so Git cannot decide whether the signature comes from someone you trust and reports an error instead of a verdict. The signature itself may be perfectly valid. On the signing side, "either user.signingkey or gpg.ssh.defaultKeyCommand needs to be configured" is the equivalent configuration gap.

Why it happens

• SSH signing set up, verification never configured

  common

  Guides for SSH commit signing usually stop at `gpg.format ssh` and `user.signingkey`. Signing works; verification needs `gpg.ssh.allowedSignersFile` as well.

• The configured file does not exist

  occasional

  A path from a dotfiles repository that is not present on this machine, or `~` not expanded where the config was written.

• Verification in CI without the signers file

  occasional

  Branch-protection or release scripts that run `git verify-commit` need the allowed signers file in the job, not only on developer machines.

How to fix it

1. 1.

   Create an allowed signers file

   Each line: principal(s), optional options such as `namespaces="git"`, then the public key. Git checks the committer email against the principal.

   # One line per trusted signer: principal (email) + public key; namespaces restricts it to git
   echo "alice@example.com namespaces=\"git\" $(cut -d' ' -f1,2 ~/.ssh/id_ed25519.pub)" >> ~/.config/git/allowed_signers
   git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers
   git verify-commit HEAD

2. 2.

   Keep the team's signers in the repository

   A reviewed file in the repository lets everyone (and CI) verify the same set of keys; changes to it go through code review.

   # Team setup: a reviewed allowed_signers file in the repository
   git config gpg.ssh.allowedSignersFile .github/allowed_signers
   git log --show-signature -1

← Browse the full signature error database