{"record":{"id":"7f36c200267383b2","repo":"theonedev/onedev","slug":"valid-signature-required-for-head-commit-of-this-b","errorCode":null,"errorMessage":"Valid signature required for head commit of this branch per branch protection rule","messagePattern":"Valid signature required for head commit of this branch per branch protection rule","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/service/impl/DefaultIssueService.java","lineNumber":1496,"sourceCode":"\n\t\tif (!SecurityUtils.canCreateBranch(project, suggestedBranch))\n\t\t\tthrow new UnauthorizedException(\"No permission to create branch: \" + suggestedBranch);\n\n\t\tif (project.getBranchRef(suggestedBranch) != null) {\n\t\t\tthrow new NotAcceptableException(MessageFormat.format(\"Branch \\\"{0}\\\" already exists\", suggestedBranch));\n\t\t} else {\n\t\t\tRevCommit commit = null;\n\t\t\tif (issue.getFieldCommitId() != null)\n\t\t\t\tcommit = project.getRevCommit(issue.getFieldCommitId(), false);\n\t\t\tif (commit == null) {\n\t\t\t\tString defaultBranch = project.getDefaultBranch();\n\t\t\t\tif (defaultBranch == null) \n\t\t\t\t\tthrow new NotAcceptableException(\"Default branch is not available\");\n\t\t\t\telse \n\t\t\t\t\tcommit = project.getRevCommit(defaultBranch, true);\t\n\t\t\t}\t\t\n\t\t\tif (!project.isCommitSignatureRequirementSatisfied(SecurityUtils.getUser(subject), suggestedBranch, commit)) {\n\t\t\t\tthrow new NotAcceptableException(\"Valid signature required for head commit of this branch per branch protection rule\");\n\t\t\t} else {\n\t\t\t\tgitService.createBranch(project, suggestedBranch, commit.name());\n\t\t\t\treturn suggestedBranch;\n\t\t\t}\n\t\t}\n\t}\n}\n","sourceCodeStart":1478,"sourceCodeEnd":1504,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/service/impl/DefaultIssueService.java#L1478-L1504","documentation":"OneDev throws this NotAcceptableException when the head commit of the branch that would be created does not satisfy the project's commit signature requirement. isCommitSignatureRequirementSatisfied checked the signature of the resolved commit against branch protection rules for the acting user, and it failed (unsigned, untrusted signature, or signer not verified).","triggerScenarios":"Requesting branch creation from an issue when branch protection rules require valid GPG/signed commits and the source commit (issue's commit or default-branch head) is unsigned or signed with an untrusted/unverified key.","commonSituations":"CI or bots creating branches via API with unsigned commits; developer with unconfigured GPG signing pushing commits used as branch base; branch protection tightened after the commit was created; signature verification (gpg key server / trust settings) not set up on the server.","solutions":["Sign the head commit with a GPG/SSH key that the server trusts and verify it (git commit -S)","Configure commit signing locally: git config commit.gpgsign true and set user.signingkey","Upload/register the signing key in user profile settings so OneDev can verify it","Relax the signature requirement in branch protection rules if signatures are not needed","Pick a different, signed base commit by setting issue.fieldCommitId"],"exampleFix":"// before: unsigned commit used as branch base\n$ git commit -m \"work\"\n// after: signed commit\n$ git config commit.gpgsign true\n$ git commit -S -m \"work\"","handlingStrategy":"validation","validationCode":"var commit = issue.getFieldCommitId() != null\n    ? project.getRevCommit(issue.getFieldCommitId(), false)\n    : project.getRevCommit(project.getDefaultBranch(), true);\nif (commit != null && !project.isCommitSignatureRequirementSatisfied(SecurityUtils.getUser(), branchName, commit)) {\n    throw new ExplicitException(\"Head commit signature does not satisfy branch protection rules.\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    issueService.openBranch(project, issue, branchName, subject);\n} catch (NotAcceptableException e) {\n    if (e.getMessage().contains(\"Valid signature required\")) {\n        // re-sign commit and retry, or adjust branch protection\n    } else throw e;\n}","preventionTips":["Enable git commit.gpgsign for all identities that publish commits","Register signing keys in OneDev user profiles","Review branch protection signature rules before automating branch creation"],"tags":["git","signature","branch-protection","security"],"backgroundTag":"signature-verification-failed","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}