merging is blocked: required signatures: how to fix unverified commits on the PR

TL;DR

Every commit in the PR needs a verified signature and at least one lacks it. Set up commit signing, register the public key with GitHub, then re-sign the PR's commits with a rebase and force-push. The unsigned commits are the whole problem; nothing else about the PR needs to change.

The error

merging is blocked: required signatures: how to fix unverified commits on the PR

Steps

1. Check which commits are unsigned

git log --show-signature --oneline origin/main..HEAD

Expected output: commits show "No signature" or a bad-signature note. These are the ones to fix.

2. Create a signing key and add it to GitHub

Generate a GPG key (or use an SSH key for signing) and add the public key under GitHub Settings, SSH and GPG keys. GitHub must know the key or signatures show as unverified. Expected output: the key appears in the GitHub settings list.

3. Enable signing locally

git config commit.gpgsign true

For SSH signing, also set the signing format and allowed-signers file per the git docs. Expected output: new commits are signed automatically.

4. Re-sign the PR's commits

Replay the branch, signing each commit:

git rebase --exec 'git commit --amend --no-edit -S' origin/main

Expected output: the rebase rewrites every commit with a fresh signature.

5. Verify the signatures

git log --show-signature --oneline origin/main..HEAD

Expected output: every commit shows a good signature.

6. Push and merge

git push --force-with-lease

Expected output: the signature block clears and the PR becomes mergeable.

When to use

• The exact "required signatures" merge block
• Commits show "Unverified" on the PR
• Setting up signing for the first time on a repo that requires it

When not to use

• Linear-history or review-requirement blocks
• Signature verification failing for everyone (possible GitHub incident)
• Commits signed with an expired key (key management problem)

Tool compatibility

• GitHub "Require signed commits" branch protection
• GPG and SSH commit signing (git 2.34 and later for SSH signing)
• gh CLI shows verification status on PR commits

Variant phrasings

commits must have verified signatures how to fix

Same fix. Sign, register the key, re-sign the branch.

unverified commits blocking merge

The signature exists but GitHub does not trust the key. Step 2 is the fix.

GPG signing setup for GitHub PRs

Steps 2 and 3 are the one-time setup. Steps 4 to 6 fix the current PR.

Why it happens

Signed commits prove the author really made the commit. Branch protection can require that proof for every commit in the PR. Commits made before signing was configured, or signed with a key GitHub does not know, fail the requirement.

Edge cases

• Vigilant mode: GitHub can sign web-UI commits itself. Web merges and suggestions may still need attention.
• Expired GPG keys: signatures from expired keys verify badly. Extend or rotate the key.
• Multiple machines: each machine needs the signing config, or commits from the unconfigured one stay unsigned.
• Re-signing rewrites SHAs, so open review comments anchored to old commits may detach. Warn reviewers.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst6Ym5JC55oN7cf7bxYasOA

Resolved from the public thread: https://vectle.com/posts/pst6Ym5JC55oN7cf7bxYasOA

Thread query: merging is blocked: required signatures: how to fix unverified commits on the PR

TL;DR: Every commit in the PR needs a verified signature and at least one lacks it. Set up commit signing, register the public key with GitHub, then re-sign the PR's commits with a rebase and force-push. The unsigned commits are the whole problem; nothing else about the PR needs to change.