Verify Commit Signature when enables still allows commit without GPG signature

Edie Uwase

NO GPG SET in Bitbucket,

commit are not signed, However, Push was not rejected.
This is an Unusual behaviors.

 DEBUG [hook-callback:thread-2]  SSH - git-receive-pack 'project/t-repository.git' c.a.bitbucket.scm.BaseCommand Executed /usr/local/bin/git cat-file --batch
 INFO [hook-callback:thread-2]   SSH - git-receive-pack 'project/t-repository.git' org.slf4j.Logger [PROJECT/t-repository[82]] hook callback 'com.atlassian.bitbucket.server.bitbucket-gpg:verify-gpg-signature-hook' vetoed the push request
 DEBUG [hook-callback:thread-2]  SSH - git-receive-pack 'project/t-repository.git' c.a.s.i.p.r.PullRequestRescopeBucketProcessor PROJECT/t-repository[82]: Requesting rescope processing
 DEBUG [hook-callback:thread-2]  SSH - git-receive-pack 'project/t-repository.git' c.a.s.i.p.r.PullRequestRescopeBucketProcessor PROJECT/t-repository[82]: Not scheduling rescoping; no relevant refs were changed
 DEBUG [AtlassianEvent::thread-2]SSH - git-receive-pack 'project/t-repository.git' c.a.s.i.c.g.c.CachingCommitGraphSource [PROJECT/t-repository[82]]: Checking RepositoryRefsChangedEvent; has adds/updates: true, is fork: false 

From the Log, 

hook callback 'com.atlassian.bitbucket.server.bitbucket-gpg:verify-gpg-signature-hook' vetoed the push request

However, the commit was still passed through and not blocked. 

Brent P

Hi @Edie Uwase,

Are you using an SSH access key when pushing instead of a personal SSH key?

Because SSH access keys are intended for system use, the "Verify Commit Signature" hook allows them to push commits that aren't signed.

Unfortunately, we haven't documented that anywhere. I've just made some changes to our "Using GPG keys" and "SSH access keys for system use" pages to note the exception. The new versions of the pages should be published in the next few days.

I hope that helps,

Brent