gpg: Can't check signature: No public key

GnuPG 2.4 writes "No public key"; translations and older builds may differ in case. Git's verify commands exit non-zero and pass gpg's output through.

What it means

The object is signed, and gpg found the signature, but the keyring has no public key matching the issuer's fingerprint, so it cannot say whether the signature is good or bad. The preceding lines ("Signature made …", "using … key <fingerprint>") tell you which key you need. This is not a failed signature — it is a missing key.

Why it happens

• The signer's key was never imported

  common

  A fresh machine, a CI runner, a separate `GNUPGHOME`, or a teammate whose key you never received.

• No automatic key retrieval

  occasional

  GnuPG does not fetch keys automatically unless `auto-key-retrieve` and a keyserver are configured; many keyservers no longer serve user IDs without verification.

• The signing subkey is newer than your copy

  occasional

  If the signer added a new signing subkey, an old copy of their public key lacks it. Refresh the key from its source.

How to fix it

1. 1.

   Import the key from a trusted source

   Import from the project's website, release notes or a keyserver, and verify the fingerprint through a separate channel before trusting signatures.

   # Import the signer's key from a trusted source, then compare the fingerprint out of band
   curl -sSL https://example.com/release-signing-key.asc | gpg --import
   gpg --fingerprint release@example.com
   git verify-commit HEAD

2. 2.

   Use the keys a platform publishes

   GitHub serves each user's registered GPG keys at `https://github.com/<user>.gpg`.

   # Keys a GitHub user registered for signing (verify the fingerprint before trusting it)
   curl -sSL https://github.com/<user>.gpg | gpg --import

← Browse the full signature error database