Search code examples
githubgnupggpg-signature

If I change my GPG key on GitHub, will my previous commits appear as not verified?

Let's say I do the following:

  1. Create new GPG signing key
  2. Add it to GitHub
  3. Delete the old key from GitHub

Will my previous commits still appear as verified?

Solution

  • Commits are displayed as "Unverified", if you delete the associated key from your GitHub user profile. See the GitHub docs here.

    When you delete a key, GitHub displays a conformation dialog that includes the warning:

    This action cannot be undone. This will permanently delete the GPG key. and if you'd like to use it in the future, you will need to upload it again.

    Any commits you signed with this key will become unverified after removing it.

    After deleting a key, associated commits are displayed as "Unverified". Clicking on the Unverified button will display instructions to upload the public signing key, along with the key ID.