GPG-Signed tags are marked as unverified - commits are fine

How to Use GitLab
1

Problem to solve

I created a GitLab CI Pipeline that signs commits and tags with a GPG key. The key is loaded from a global CI variable before any commits are made. The GPG public key is added to GitLab.

I enabled signing via git config with:

git config user.signingkey <gpg key id>
git config commit.gpgsign true
git config tag.gpgSign true

Whe I create commits in the CI pipeline, they are signed and when pushed they show up as verified in the GitLab ui.

But when I create tags and push them in the CI pipeline they show up as unverified in the GitLab ui, with the following error message:

image
image307×167 9.19 KB

When viewing the tag metadata in the CLI I get the correct information:

image
image666×166 4.83 KB

The “tagger” matches the “Korrekte Signatur von” and “Aussteller” from the gpg output the used gpg key id also matches what is loaded in CI pipeline.

Steps to reproduce

  1. Create a valid GPG key
  2. Export the private GPG key in ASCII format and encrypt it with base64
  3. Store the GPG private key as a CI variable in GitLab
  4. Export the public GPG key in ASCII format and add it to your GPG keys in GitLab preferences
  5. In the CI pipeline
    1. Load the GPG private key using gpg
    2. Enable commit and tag signing in git config
    3. Create a commit and push it
    4. Create a tag and push it
  6. The commit is verified
  7. The tag is unverified

Versions

  • Self-managed; GitLab Enterprise Edition v18.1.1-ee