Could not make my second mail's commits as "verified" on GitHub
Currently, I use 2 emails, (Personal + Company) with one SSH key to log in to GitHub. But I use the same GPG key for signing. Both are verified on my GitHub Email Settings page.
On the first one (personal), no issue, when I do a commit it appears as Verified. On the second one (company), the commits appear as Unverified in GitHub with the following warning message:
The email in this signature doesn’t match the committer email.
$ gpg --list-secret-keys --keyid-format LONG
...
sec rsa4096/MY_GPG_KEY_ID 2020-05-19 [SC] [expires: 2022-05-19]
...
uid [ultimate] Furkan (Company key) <second_email@test.com>
uid [ultimate] Furkan <first_email@test.com>
In the repository:
$ git log --show-signature
...
gpg: Good signature from "Furkan (Company key) <second_email@test.com>" [ultimate]
gpg: aka "Furkan <first_email@test.com>" [ultimate]
Author: MyGitHubNickname <second_email@test.com>
...
Local config settings:
$ git config --local --list
...
user.name=Furkan
user.email=second_email@test.com
Global config settings:
$ git config --global --list
...
user.name=MyGitHubNickname
user.email=second_email@test.com
user.signingkey=MY_40_CHARACTER_SIGNING_KEY
But did not work:
$ git commit -S --amend --reset-author
$ git push --force
I see MY_GPG_KEY_ID key at the bottom of this popup, exactly the same.
I followed Troubleshooting commit signature verification and Using a verified email address in your GPG key guides as described in GitHub Docs, but still did not fix the problem.
Everything you did so far is correct; you're just missing the final step which is to update GitHub's copy of your public key.
You need to regenerate your public key (gpg --armor --export KEY_ID), then, in your GitHub user settings > "SSH and GPG keys", you need to delete the original key and upload the regenerated public key.
This is what it should end up looking like. Commits signed with any of the listed addresses will now show as Verified.
