# git verify-commit: Usage, Options & Common CI Errors

> git verify-commit checks the GPG/SSH signature on a commit. Reference for --raw, -v, exit codes, and the no-signature and untrusted-key errors in CI gates.

Source: https://latchkey.dev/learn/command-reference/git-verify-commit  
Updated: 2026-06-25

git verify-commit checks whether a commit carries a valid, trusted signature.

Pipelines that require signed commits use verify-commit as the gate. Its exit code is the contract: zero means a good signature, non-zero means missing, bad, or untrusted.

## What it does

git verify-commit checks the cryptographic signature attached to a commit against your configured GPG or SSH keyring and reports validity, exiting non-zero if the signature is absent or cannot be trusted.

## Common usage

```Terminal
git verify-commit HEAD
git verify-commit -v <sha>
git verify-commit --raw <sha>
git log --show-signature -1
```

## Options

| Flag | What it does |
| --- | --- |
| -v / --verbose | Print the commit and signature details |
| --raw | Machine-readable GPG status lines |
| <commit> | The commit to verify |

## Common errors in CI

error: <sha>: no signature found exits non-zero - the commit is simply unsigned. "gpg: Can’t check signature: No public key" means the signer’s key is not imported on the runner; import the allowed keys first. Trust matters: a valid signature from an unknown key still fails the gate.

## Using this in CI

CI checkouts are shallow and detached by default, which changes the answer this command gives you. Commands that read history, branch names, or tags need the checkout configured for it.

```.github/workflows/ci.yml
- uses: actions/checkout@v4
  with:
    fetch-depth: 0   # history, tags, and git describe all need this

- run: |
    git rev-parse --is-shallow-repository   # expect false
    git rev-parse --abbrev-ref HEAD          # prints HEAD when detached
```

> `git rev-parse --abbrev-ref HEAD` returns the literal string `HEAD` on a detached checkout rather than a branch name. On GitHub Actions read `github.ref_name` instead; the git command cannot know what it was checked out for.

## FAQ

### git verify-commit: Usage, Options & Common CI Errors?

Pipelines that require signed commits use verify-commit as the gate. Its exit code is the contract: zero means a good signature, non-zero means missing, bad, or untrusted.

### What it does?

git verify-commit checks the cryptographic signature attached to a commit against your configured GPG or SSH keyring and reports validity, exiting non-zero if the signature is absent or cannot be trusted.

### Common errors in CI?

error: <sha>: no signature found exits non-zero - the commit is simply unsigned. "gpg: Can’t check signature: No public key" means the signer’s key is not imported on the runner; import the allowed keys first. Trust matters: a valid signature from an unknown key still fails the gate.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt