VSCode unable to sign commits

Git commit signing failures in Visual Studio Code usually stem from environment variable misconfigurations, missing GPG agent permissions, or incorrect key selection. By verifying the GPG_TTY setting, ensuring the GPG agent is running with proper terminal access, and correctly configuring Git to use your specific signing key, you can resolve these authentication errors and successfully sign your commits within the VSCode interface.

Verifying Environment Variables

One of the most common reasons for signing failures is the absence or incorrect value of the GPG_TTY environment variable. The GPG agent requires a valid TTY (teletype) to display prompts for passphrases securely. Without this variable, the agent cannot interact with the user, causing silent failures during the commit process. To check if this variable is set, open your terminal inside VSCode and run the following command:

echo $GPG_TTY

If the output is empty, you need to add it to your shell configuration file. For Bash users, this is typically ~/.bashrc or ~/.profile. For Zsh users, it is ~/.zshrc. Add the following line to the appropriate file:

export GPG_TTY=$(tty)

After adding this line, reload your shell configuration by running source ~/.bashrc (or source ~/.zshrc) or by restarting VSCode. This ensures that every new terminal session has access to the correct TTY device, allowing GPG to prompt for your passphrase correctly.

Configuring Git to Use the Correct Key

Even with correct environment variables, Git will fail to sign if it does not know which private key to use. You must explicitly tell Git which GPG key ID to associate with your commits. First, list your available GPG keys using the command:

gpg --list-secret-keys --keyid-format LONG

Look for the key associated with your email address used in Git. Note the long key ID (the alphanumeric string after the sec or ssb identifier). Then, configure Git to use this key by running:

git config --global user.signingkey YOUR_KEY_ID

Replace YOUR_KEY_ID with the actual ID you found. Additionally, ensure that the global configuration for committing signing is enabled:

git config --global commit.gpgsign true

This setting forces all commits made through Git to be signed automatically. If you prefer to sign only specific commits, you can omit this global setting and use the -S flag when committing manually.

Ensuring the GPG Agent is Running Properly

The GPG agent manages cryptographic operations and caches passphrases. If the agent is not running or is misconfigured, signing will fail. On macOS, Homebrew-installed GPG often requires additional setup for pinentry. Install the pinentry program if you haven't already:

brew install pinentry

Then, create or edit the ~/.gnupg/gpg-agent.conf file and add:

pinentry-program /usr/local/bin/pinentry-mac

On Linux systems, ensure that the gpg-agent service is active. You can restart it with:

gpgconf --kill gpg-agent

This forces the agent to restart and pick up any new configuration changes. It is also important to verify that the agent can communicate with your terminal. If you are using VSCode's integrated terminal, ensure that it is not running in a restricted mode that blocks interactive prompts.

Checking VSCode Specific Settings

Visual Studio Code has its own Git integration settings that might interfere with external tools like GPG. Open the Command Palette (Ctrl+Shift+P or Cmd+Shift+P) and search for "Preferences: Open User Settings (JSON)". Look for any settings related to Git execution or external programs. Ensure that the git.path setting points to the correct Git executable, especially if you have multiple versions installed. Sometimes, VSCode uses a bundled Git version that may not be linked to the system-wide GPG installation. If you suspect a path issue, specify the full path to your Git binary:

"git.path": "/usr/bin/git"

Additionally, check if there are any extensions interfering with the Git workflow. Disable non-essential Git-related extensions temporarily to see if the signing issue persists. This helps isolate whether the problem lies within VSCode's core functionality or an extension conflict. For more information on troubleshooting Git commands in VSCode, you might find our guide on How to carry out a git command without giving control to the interactive git console? helpful for understanding how VSCode handles external processes.

Testing the Configuration

After applying these fixes, test your configuration by making a small change to a file and attempting to commit. Open the Source Control view in VSCode, stage your changes, and click Commit. If successful, the commit should be signed. You can verify the signature by running:

git log -1 --show-signature

This command displays the last commit along with its signature details. If the signature is valid, you will see a message indicating that the signature is good. If it fails, review the error messages carefully, as they often point to the specific cause of the failure, such as permission denied or key not found.

Frequently Asked Questions

Why does GPG ask for a passphrase but then fail immediately?

This usually happens because the GPG agent cannot display the passphrase prompt due to a missing GPG_TTY variable. Ensure that GPG_TTY is exported in your shell profile and that the terminal supports interactive input. Restarting VSCode after setting this variable often resolves the issue.

Can I use a hardware security key like YubiKey for signing?

Yes, you can use hardware security keys. However, you must ensure that the GPG agent is configured to handle smartcard devices. This may require installing specific drivers and configuring scdaemon options in your gpg-agent.conf file. Verify that your OS recognizes the key before attempting to sign commits.

What if my Git version is too old to support signing?

Git added support for GPG signing in version 2.0. Most modern distributions include a much newer version. Check your Git version with git --version. If it is older than 2.0, consider upgrading Git through your package manager or downloading the latest release from the official Git website.

Does VSCode cache GPG passphrases?

VSCode relies on the underlying GPG agent for caching. If you want to avoid entering your passphrase repeatedly, configure the default-cache-ttl and max-cache-ttl options in your gpg-agent.conf file. This tells the agent how long to remember your passphrase in memory.

How do I fix "gpg: skipped key" errors?

This error indicates that Git is trying to use a key that is not available or not trusted. Run gpg --list-secret-keys to verify that the key exists in your local keyring. If the key is missing, you may need to import it from a backup or generate a new one and update your Git configuration accordingly.