Bitbucket Cloud · git push · Checked November 2, 2026

Bitbucket: "remote: Commit signature verification failed"

The repository requires a verified signature on every commit you push, and at least one commit in your push has none, or has one Bitbucket can't verify. Nothing changed on Bitbucket. Sign the commits on your computer and push again. The whole message, from Atlassian's article Troubleshooting common Bitbucket Cloud GPG key issues to use signed commits:

remote: Commit signature verification failed
To https://bitbucket.org/<workspace>/<repo>.git
 ! [remote rejected] branch -> branch (pre-receive hook declined)
error: failed to push some refs to 'https://bitbucket.org/<workspace>/<repo>.git'

The setting behind it

Atlassian's Require signed commits is for Premium workspaces. A repository admin turns it on under Repository settings, Repository details, Advanced: Require all commits to have a verified signature. From then on, a push fails if any commit in it is unsigned or has a signature that doesn't verify. Commits already in the repository stay as they are.

The same page says pull requests merged in Bitbucket's web interface are not checked, and Atlassian's page on SSH signing lists commits made in the web interface, or by a merge strategy when Bitbucket merges a pull request, as "No signature".

When the push is refused with only the "pre-receive hook declined" line and no "Commit signature verification failed" above it, the cause is usually a branch restriction ("pre-receive hook declined").

Find the commits without a signature

git log --format='%h %G? %s' origin/main..HEAD

N means no signature, G a good one. For SSH signatures, Git checks against an allowed signers file. In our test without one, Git printed this and showed N even for signed commits:

error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification

To see whether a commit carries a signature at all, whatever its kind, look for a gpgsig line in git cat-file commit <commit>.

Sign them again

git rebase -f -S origin/main
git push

This rewrites every commit after origin/main with your signature. Keep the -f: in our test, git rebase -S alone answered Current branch t2 is up to date. and signed nothing. With a merge commit in the branch, add --rebase-merges; our merge commit came out signed too. The commits get new IDs, which is fine here because Bitbucket refused them and has none of them.

So that new commits are signed without -S:

git config --global commit.gpgsign true

Without it, git commit --amend dropped the signature from our commit.

Signing that Bitbucket can verify

Bitbucket verifies a signature with a key added to your account, and the commit's email must match it.

• GPG (Use GPG keys to sign commits): create a key with gpg --full-generate-key using the email of your Bitbucket account, add the public key under Personal Bitbucket settings, GPG keys, and tell Git with git config --global user.signingkey <key ID>.
• SSH (Use SSH keys to sign commits, Git 2.34 or later): git config --global gpg.format ssh and git config --global user.signingkey ~/.ssh/id_ed25519.pub. A key you already use to authenticate with Bitbucket can sign too.

Bitbucket then shows a commit as Verified, Unverified or No signature. Unverified, per the SSH page: the email does not match, the key is not on any Bitbucket account, or the key is unsupported, deleted or revoked. Both pages note that only commits pushed from the command line can be verified for now.

When Git can't sign

From the troubleshooting article:

• error: cannot run gpg: No such file or directory: GPG is not installed, or Git can't find it. Install it, or set git config --global gpg.program "$(which gpg)".
• error: gpg failed to sign the data with fatal: failed to write commit object: the key may have expired (GPG says Unusable secret key; extend it with gpg --edit-key <key ID> and expire), or user.signingkey names another key.
• On a Mac with GPG from Homebrew, also gpg: signing failed: Inappropriate ioctl for device: the article sets GPG_TTY and installs pinentry-mac for the passphrase.

Signing from IntelliJ IDEA

JetBrains' Set up GPG commit signing: in Settings, Version Control, Git, click Configure GPG Key and select Sign commits with GPG key. GPG asks for the passphrase in a pinentry window, so it needs a pinentry that shows one; the page tests it with echo GETPIN | pinentry. On Windows, Git for Windows 2.19.2 or later comes with GPG.

Create Bitbucket pull requests from IntelliJ IDEA

Pull Request Inbox for Bitbucket, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, adds Git → Create Bitbucket Pull Request… for Bitbucket Cloud and Data Center. It opens a pull request from the branch you are on, into the repository's main branch unless you pick another. If the branch is not on Bitbucket yet, it says so and opens the IDE's push dialog first. Creating, approving and merging pull requests are Pro (US$1.50 a month, with a 30-day trial); the review inbox is free.

Get it on JetBrains Marketplace

Bitbucket and Atlassian are trademarks of Atlassian; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by Atlassian or JetBrains.

More: "pre-receive hook declined" from a branch restriction · Bitbucket pull request plugins for IntelliJ IDEA, compared · 日本語