{"record":{"id":"5d146f44b06a5e38","repo":"theonedev/onedev","slug":"cannot-create-this-branch-as-branch-protection-set","errorCode":null,"errorMessage":"Cannot create this branch as branch protection setting requires valid signature on head commit","messagePattern":"Cannot create this branch as branch protection setting requires valid signature on head commit","errorType":"http","errorClass":"ExplicitException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/RepositoryResource.java","lineNumber":165,"sourceCode":"\t}\n\n\t@Api(order=30, description=\"Create a new branch\")\n\t@Path(\"/{projectId}/branches\")\n\t@POST\n\tpublic Response createBranch(@PathParam(\"projectId\") Long projectId, @NotNull CreateBranchRequest request) {\n\t\tProject project = projectService.load(projectId);\n\t\tUser user = SecurityUtils.getUser();\n\t\tif (!SecurityUtils.canWriteCode(project)) \n\t\t\tthrow new UnauthorizedException();\n\t\telse if (project.getBranchRef(request.getBranchName()) != null) \n\t\t\tthrow new NotAcceptableException(\"Branch '\" + request.getBranchName() + \"' already exists\");\n\t\telse if (project.getBranchProtection(request.getBranchName(), user).isPreventCreation()) \n\t\t\tthrow new ExplicitException(\"Branch creation prohibited by branch protection rule\");\n\t\t\n\t\tif (!project.isCommitSignatureRequirementSatisfied(\n\t\t\t\tuser, request.getBranchName(), \n\t\t\t\tproject.getRevCommit(request.getRevision(), true))) {\n\t\t\tthrow new ExplicitException(\"Cannot create this branch as branch protection setting \"\n\t\t\t\t\t+ \"requires valid signature on head commit\");\n\t\t}\n\t\t\n\t\tgitService.createBranch(project, request.getBranchName(), request.getRevision());\n\n\t\treturn Response.ok().build();\n\t}\n\n\t@Api(order=40, description=\"Delete specified branch\")\n\t@Path(\"/{projectId}/branches/{branch:.*}\")\n\t@DELETE\n\tpublic Response deleteBranch(@PathParam(\"projectId\") Long projectId, \n\t\t\t@PathParam(\"branch\") @Api(example=\"test-branch\") String branchName) {\n\t\tProject project = projectService.load(projectId);\n\t\tif (!SecurityUtils.canDeleteBranch(project, branchName)) \n\t\t\tthrow new UnauthorizedException();\n\t\t\n\t\tprojectService.deleteBranch(project, branchName);","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/RepositoryResource.java#L147-L183","documentation":"POST /{projectId}/branches throws ExplicitException when branch protection requires a valid signature on the head commit but the commit pointed to by the requested revision is unsigned or has an invalid signature. OneDev refuses to point the protected branch at an unverified commit.","triggerScenarios":"Calling POST /~api/{projectId}/branches with a revision whose head commit fails project.isCommitSignatureRequirementSatisfied for the acting user, because commit signing is required for that branch pattern.","commonSituations":"Branching from a merge bot commit or CI-generated commit that is unsigned; commits made locally without gpg/ssh signing configured; signatures from untrusted keys.","solutions":["Create the branch from a signed commit (git commit -S locally configured with a trusted key)","Ask an admin to disable the signature requirement for that branch pattern","Sign and re-push the head commit (rebase or amend with signing) then use its hash as revision"],"exampleFix":"// before\ngit commit -m \"wip\" // unsigned\nPOST /~api/1/branches {\"branchName\":\"dev\",\"revision\":\"HEAD\"}\n// after\ngit commit -S -m \"wip\" && git push\nPOST /~api/1/branches {\"branchName\":\"dev\",\"revision\":\"<signed-commit-hash>\"}","handlingStrategy":"validation","validationCode":"// verify head commit signature locally before branching\ngit verify-commit <hash> || echo 'signature invalid; branch creation will be rejected'","typeGuard":null,"tryCatchPattern":"try {\n  createBranch(projectId, req);\n} catch (ExplicitException e) {\n  // instruct user to branch from a signed commit\n}","preventionTips":["Configure git commit signing (git config commit.gpgsign true)","Sign bot/CI-generated commits where policies require it","Branch only from signed, verified revisions on protected projects"],"tags":["rest","git","commit-signing","branch-protection"],"backgroundTag":"insufficient-permissions","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}