theonedev/onedev · error · ExplicitException

Tag signature required, please generate system GPG signing k

Error message

Tag signature required, please generate system GPG signing key first

What it means

DefaultGitService.createTag builds an annotated tag and, when the tag must be signed (signRequired, e.g. repository setting 'tag signature required' or user-level enforcement), signs with the system GPG signing key. If no system GPG signing key is configured in the server's GPG settings, it throws ExplicitException("Tag signature required, please generate system GPG signing key first").

Source

Thrown at server-core/src/main/java/io/onedev/server/git/service/DefaultGitService.java:291

					ObjectInserter inserter = getRepository(projectId).newObjectInserter();) {
				TagBuilder tagBuilder = new TagBuilder();
				tagBuilder.setTag(tagName);
				if (tagMessage != null) {
					if (!tagMessage.endsWith("\n"))
						tagBuilder.setMessage(tagMessage + "\n");
					else
						tagBuilder.setMessage(tagMessage);
				}
				tagBuilder.setTagger(taggerIdent);
				
				RevCommit commit = revWalk.parseCommit(revId);
				tagBuilder.setObjectId(commit);

				PGPSecretKeyRing signingKey = settingService.getGpgSetting().getSigningKey();
				if (signingKey != null) { 
					GitUtils.sign(tagBuilder, signingKey);
				} else if (signRequired) {
					throw new ExplicitException("Tag signature required, please generate "
							+ "system GPG signing key first");
				}

				ObjectId tagId = inserter.insert(tagBuilder);
				inserter.flush();

				String refName = GitUtils.tag2ref(tagName);
				RefUpdate refUpdate = repository.updateRef(refName);
				refUpdate.setNewObjectId(tagId);
				GitUtils.updateRef(refUpdate);

				return new TaggingResult(tagId, commit.copy());
			} catch (IOException e) {
				throw new RuntimeException(e);
			}
		});
		project.cacheObjectId(tagName, tagAndCommitId.getTagId());
		listenerRegistry.post(new RefUpdated(project, 

View on GitHub (pinned to d44925c47c)

Solutions

1. Go to Administration > GPG Settings and generate the system GPG signing key, then retry the tag creation
2. Disable the 'tag signature required' setting on the repository/user if signing is not needed
3. Import an existing key as the system signing key instead of generating a new one

Example fix

// before (server has no signing key, signRequired=true)
gitService.createTag(..., signRequired=true); // throws
// after
// 1) Administration > GPG Settings > 'Generate Key'
// 2) then:
gitService.createTag(..., signRequired=true);

// check before creating a required-signature tag
boolean signRequired = /* repo/user setting */;
boolean hasKey = settingService.getGpgSetting().getSigningKey() != null;
if (signRequired && !hasKey)
  throw new IllegalStateException("Generate system GPG signing key first (Admin > GPG Settings)");

try {
  gitService.createTag(projectId, tag, commitId, tagMessage, signRequired);
} catch (ExplicitException e) {
  if (e.getMessage().contains("Tag signature required")) {
    // guide admin to Administration > GPG Settings > Generate Key
  }
}

When it happens

Trigger: Creating a tag via DefaultGitService.createTag on a repository/user where signed tags are required while settingService.getGpgSetting().getSigningKey() returns null — i.e. no GPG key pair generated under Server Config > GPG.

Common situations: Fresh OneDev install where the admin never generated the system GPG key; a project with 'Require signature on tags' enabled after a settings import or server migration that lost the key; calling createTag from a plugin/CI without configuring GPG.

Related errors

• Commit signature required, please generate system GPG signin
• No default branch
• Default branch is not available
• Unrecognized command:
• Unable to discover cluster ip from database connection url:

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/f3108efc9a38f15e. Report an issue: GitHub.