{"record":{"id":"f3108efc9a38f15e","repo":"theonedev/onedev","slug":"tag-signature-required-please-generate-system-gpg","errorCode":null,"errorMessage":"Tag signature required, please generate system GPG signing key first","messagePattern":"Tag signature required, please generate system GPG signing key first","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/git/service/DefaultGitService.java","lineNumber":291,"sourceCode":"\t\t\t\t\tObjectInserter inserter = getRepository(projectId).newObjectInserter();) {\n\t\t\t\tTagBuilder tagBuilder = new TagBuilder();\n\t\t\t\ttagBuilder.setTag(tagName);\n\t\t\t\tif (tagMessage != null) {\n\t\t\t\t\tif (!tagMessage.endsWith(\"\\n\"))\n\t\t\t\t\t\ttagBuilder.setMessage(tagMessage + \"\\n\");\n\t\t\t\t\telse\n\t\t\t\t\t\ttagBuilder.setMessage(tagMessage);\n\t\t\t\t}\n\t\t\t\ttagBuilder.setTagger(taggerIdent);\n\t\t\t\t\n\t\t\t\tRevCommit commit = revWalk.parseCommit(revId);\n\t\t\t\ttagBuilder.setObjectId(commit);\n\n\t\t\t\tPGPSecretKeyRing signingKey = settingService.getGpgSetting().getSigningKey();\n\t\t\t\tif (signingKey != null) { \n\t\t\t\t\tGitUtils.sign(tagBuilder, signingKey);\n\t\t\t\t} else if (signRequired) {\n\t\t\t\t\tthrow new ExplicitException(\"Tag signature required, please generate \"\n\t\t\t\t\t\t\t+ \"system GPG signing key first\");\n\t\t\t\t}\n\n\t\t\t\tObjectId tagId = inserter.insert(tagBuilder);\n\t\t\t\tinserter.flush();\n\n\t\t\t\tString refName = GitUtils.tag2ref(tagName);\n\t\t\t\tRefUpdate refUpdate = repository.updateRef(refName);\n\t\t\t\trefUpdate.setNewObjectId(tagId);\n\t\t\t\tGitUtils.updateRef(refUpdate);\n\n\t\t\t\treturn new TaggingResult(tagId, commit.copy());\n\t\t\t} catch (IOException e) {\n\t\t\t\tthrow new RuntimeException(e);\n\t\t\t}\n\t\t});\n\t\tproject.cacheObjectId(tagName, tagAndCommitId.getTagId());\n\t\tlistenerRegistry.post(new RefUpdated(project, ","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/git/service/DefaultGitService.java#L273-L309","documentation":"DefaultGitService.createTag builds an annotated tag and, when the tag must be signed (signRequired, e.g. repository setting 'tag signature required' or user-level enforcement), signs with the system GPG signing key. If no system GPG signing key is configured in the server's GPG settings, it throws ExplicitException(\"Tag signature required, please generate system GPG signing key first\").","triggerScenarios":"Creating a tag via DefaultGitService.createTag on a repository/user where signed tags are required while settingService.getGpgSetting().getSigningKey() returns null — i.e. no GPG key pair generated under Server Config > GPG.","commonSituations":"Fresh OneDev install where the admin never generated the system GPG key; a project with 'Require signature on tags' enabled after a settings import or server migration that lost the key; calling createTag from a plugin/CI without configuring GPG.","solutions":["Go to Administration > GPG Settings and generate the system GPG signing key, then retry the tag creation","Disable the 'tag signature required' setting on the repository/user if signing is not needed","Import an existing key as the system signing key instead of generating a new one"],"exampleFix":"// before (server has no signing key, signRequired=true)\ngitService.createTag(..., signRequired=true); // throws\n// after\n// 1) Administration > GPG Settings > 'Generate Key'\n// 2) then:\ngitService.createTag(..., signRequired=true);","handlingStrategy":"try-catch","validationCode":"// check before creating a required-signature tag\nboolean signRequired = /* repo/user setting */;\nboolean hasKey = settingService.getGpgSetting().getSigningKey() != null;\nif (signRequired && !hasKey)\n  throw new IllegalStateException(\"Generate system GPG signing key first (Admin > GPG Settings)\");","typeGuard":null,"tryCatchPattern":"try {\n  gitService.createTag(projectId, tag, commitId, tagMessage, signRequired);\n} catch (ExplicitException e) {\n  if (e.getMessage().contains(\"Tag signature required\")) {\n    // guide admin to Administration > GPG Settings > Generate Key\n  }\n}","preventionTips":["Generate the system GPG key right after server setup","Audit project/user 'require tag signature' settings before scripted tagging","Back up GPG settings during server migrations"],"tags":["git","gpg","tag-signing","configuration"],"backgroundTag":"missing-credentials","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}