theonedev/onedev · error · NotAcceptableException

Valid signature required for head commit of this branch per

Error message

Valid signature required for head commit of this branch per branch protection rule

What it means

OneDev throws this NotAcceptableException when the head commit of the branch that would be created does not satisfy the project's commit signature requirement. isCommitSignatureRequirementSatisfied checked the signature of the resolved commit against branch protection rules for the acting user, and it failed (unsigned, untrusted signature, or signer not verified).

Source

Thrown at server-core/src/main/java/io/onedev/server/service/impl/DefaultIssueService.java:1496

		if (!SecurityUtils.canCreateBranch(project, suggestedBranch))
			throw new UnauthorizedException("No permission to create branch: " + suggestedBranch);

		if (project.getBranchRef(suggestedBranch) != null) {
			throw new NotAcceptableException(MessageFormat.format("Branch \"{0}\" already exists", suggestedBranch));
		} else {
			RevCommit commit = null;
			if (issue.getFieldCommitId() != null)
				commit = project.getRevCommit(issue.getFieldCommitId(), false);
			if (commit == null) {
				String defaultBranch = project.getDefaultBranch();
				if (defaultBranch == null) 
					throw new NotAcceptableException("Default branch is not available");
				else 
					commit = project.getRevCommit(defaultBranch, true);	
			}		
			if (!project.isCommitSignatureRequirementSatisfied(SecurityUtils.getUser(subject), suggestedBranch, commit)) {
				throw new NotAcceptableException("Valid signature required for head commit of this branch per branch protection rule");
			} else {
				gitService.createBranch(project, suggestedBranch, commit.name());
				return suggestedBranch;
			}
		}
	}
}

View on GitHub (pinned to d44925c47c)

Solutions

1. Sign the head commit with a GPG/SSH key that the server trusts and verify it (git commit -S)
2. Configure commit signing locally: git config commit.gpgsign true and set user.signingkey
3. Upload/register the signing key in user profile settings so OneDev can verify it
4. Relax the signature requirement in branch protection rules if signatures are not needed
5. Pick a different, signed base commit by setting issue.fieldCommitId

Example fix

// before: unsigned commit used as branch base
$ git commit -m "work"
// after: signed commit
$ git config commit.gpgsign true
$ git commit -S -m "work"

var commit = issue.getFieldCommitId() != null
    ? project.getRevCommit(issue.getFieldCommitId(), false)
    : project.getRevCommit(project.getDefaultBranch(), true);
if (commit != null && !project.isCommitSignatureRequirementSatisfied(SecurityUtils.getUser(), branchName, commit)) {
    throw new ExplicitException("Head commit signature does not satisfy branch protection rules.");
}

try {
    issueService.openBranch(project, issue, branchName, subject);
} catch (NotAcceptableException e) {
    if (e.getMessage().contains("Valid signature required")) {
        // re-sign commit and retry, or adjust branch protection
    } else throw e;
}

When it happens

Trigger: Requesting branch creation from an issue when branch protection rules require valid GPG/signed commits and the source commit (issue's commit or default-branch head) is unsigned or signed with an untrusted/unverified key.

Common situations: CI or bots creating branches via API with unsigned commits; developer with unconfigured GPG signing pushing commits used as branch base; branch protection tightened after the commit was created; signature verification (gpg key server / trust settings) not set up on the server.

Related errors

• Branch creation prohibited by branch protection rule
• Cannot create this branch as branch protection setting requi
• Authentication required
• Access denied
• Unable to remove mandatory reviewers:

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/7f36c200267383b2. Report an issue: GitHub.