Hacker News Reader

Comment by pietroalbini | Hacker News Reader

If your commits aren't marked as verified in the repository, push a new signed commit to that repo. Then GitHub should start marking your commits (even the old ones) are verified. Apparently this needs to be done per-repo, it's not global to your account.

I guess that's the way they check if you are the owner of that key.

Edit: clarified

View on HN

It shouldn't be necessary to push a new signed commit for old ones to start showing the "verified" badge. We do cache some of our templates though, so it may take a while for some pages to be updated.

I mean I get an error message when adding my key on Github:

> There was an error parsing that key. Check that the key is valid and try again.

It accepted an ascii-armored export of my key (gpg --armor --export $GPGKEY), have you tried to add that?

I did and it failed to parse.

same here, I tried with both gpg2 and gpg

PS: the problem was that I had multiple keys locally... but weirdly, now that I managed to upload my correct one, my commits are still seen as unsigned

Apparently I had the same issue... I specified the key ID when exporting, instead of the email address, and it worked!

Funny enough, in my case it was the opposite (but I have multiple keys for the same email address). Also, the problem about the commit still appearing ad unverified was just a temporary issue: by looking at another repository the changes were verified correctly (I guess that github caches gpg output, and doesn't reexecutes it with every page load, obviously)

There is a known bug where leading whitespace can cause the key to not be parsed. Also, check that you're only trying to upload a single key, and not your entire keyring.

Reply on news.ycombinator.com