Could not make my second mail's commits as "verified" on GitHub

Question

Currently, I use 2 emails, (Personal + Company) with one SSH key to log in to GitHub. But I use the same GPG key for signing. Both are verified on my GitHub Email Settings page.

On the first one (personal), no issue, when I do a commit it appears as Verified. On the second one (company), the commits appear as Unverified in GitHub with the following warning message:

The email in this signature doesn’t match the committer email.

$ gpg --list-secret-keys --keyid-format LONG

...
sec   rsa4096/MY_GPG_KEY_ID 2020-05-19 [SC] [expires: 2022-05-19]
...
uid    [ultimate] Furkan (Company key) <[email protected]>
uid    [ultimate] Furkan <[email protected]>

In the repository:

$ git log --show-signature

...
gpg: Good signature from "Furkan (Company key) <[email protected]>" [ultimate]
gpg:                 aka "Furkan <[email protected]>" [ultimate]
Author: MyGitHubNickname <[email protected]>
...

Local config settings:

$ git config --local --list

...
user.name=Furkan
[email protected]

Global config settings:

$ git config --global --list

...
user.name=MyGitHubNickname
[email protected]
user.signingkey=MY_40_CHARACTER_SIGNING_KEY

But did not work:

$ git commit -S --amend --reset-author
$ git push --force

I see MY_GPG_KEY_ID key at the bottom of this popup, exactly the same.

I followed Troubleshooting commit signature verification and Using a verified email address in your GPG key guides as described in GitHub Docs, but still did not fix the problem.

Answer 1

Everything you did so far is correct; you're just missing the final step which is to update GitHub's copy of your public key.

You need to regenerate your public key (gpg --armor --export KEY_ID), then, in your GitHub user settings > "SSH and GPG keys", you need to delete the original key and upload the regenerated public key.

This is what it should end up looking like. Commits signed with any of the listed addresses will now show as Verified.

Answer 2

In my case there was a discrepancy between committer and author. GitHub shows the author by default, but the committer was set to something auto-generated.

You can check with git log --format=full

Answer 3

As I have just discovered that you also need to be aware that if you have checked "Keep my email addresses private" in your settings and your trying to use just GPG key, that it will keep posting "unverified commit" as your email never matches. I spent days having my head done on in this, trying to figure it out, hunting forums and searches

My guess is if you use "Keep my email addresses private" you need to see what the "hidden email address" you are given is, and include it in your GPG Key "email" in your key

there is NOWHERE that mentions this! (I would have added in comments but, not enough points, but it is another answer!)