Reject Unsigned Commit push rule rejects commits signed by Weave Flux

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Summary

Commits GPG signed by Flux are rejected by the GitLab "Reject unsigned commits" Push Rule even though the signatures show as Verified when the rule is disabled. We have also raised this issue against Flux and would appreciate any support either team can provide: https://github.com/fluxcd/flux/issues/2902

Steps to reproduce

1. Set up a bot user in GitLab EE and apply a verified GPG private key and an SSH key
2. Install Weave Flux via helm using the same user SSH private key and GPG private key
3. Add a HelmRelease with the fluxcd.io/automated: true annotation and an appropriate glob pattern pointing at a GitLab EE repo with the "Committer restriction", "Reject unsigned commits" and "Check whether author is a GitLab user" Push Rules enabled
4. Wait for the initial version to deploy
5. Push a new version of the image to the registry

Example Project

N/A

What is the current bug behavior?

Flux fails to push the commit to the repo and errors

What is the expected correct behavior?

Flux updates the image.tag value in the repo, commits with a signature and pushes successfully to GitLab

Relevant logs and/or screenshots

Flux version: 1.17.1 Kubernetes version: v1.14.9-eks-502bfb

Flux error log:

flux-fluxtest-54555f9888-kpr9p flux ts=2020-03-10T15:05:41.66914859Z caller=loop.go:145 component=sync-loop jobID=84c18f9c-2763-9cf1-2161-4de495d9c42c state=done success=false err="git push git@gitlab-server:group/repo.git [master refs/notes/flux]: failed to push some refs to 'git@gitlab-server:group/repo.git', full output:\n remote: GitLab: Commit must be signed with a GPG key \nTo gitlab-server:group/repo.git\n ! [remote rejected] master -> master (pre-receive hook declined)\n ! [remote rejected] refs/notes/flux -> refs/notes/flux (pre-receive hook declined)\nerror: failed to push some refs to 'git@gitlab-server:group/repo.git'\n"

Output of checks

Results of GitLab environment info

System information
System:		Ubuntu 18.04
Proxy:		no
Current User:	git
Using RVM:	no
Ruby Version:	2.6.5p114
Gem Version:	2.7.10
Bundler Version:1.17.3
Rake Version:	12.3.3
Redis Version:	5.0.7
Git Version:	2.24.1
Sidekiq Version:5.2.7
Go Version:	unknown

GitLab information
Version:	12.7.0-ee
Revision:	c6ca82f7978
Directory:	/opt/gitlab/embedded/service/gitlab-rails
DB Adapter:	PostgreSQL
DB Version:	9.6.11
URL:		https://***
HTTP Clone URL:	https://***/some-group/some-project.git
SSH Clone URL:	git@***:some-group/some-project.git
Elasticsearch:	no
Geo:		no
Using LDAP:	yes
Using Omniauth:	yes
Omniauth Providers:

GitLab Shell
Version:	11.0.0
Repository storage paths:
- default: 	/var/opt/gitlab/git-data/repositories
- storage1: 	/var/opt/gitlab/git-data/repositories
GitLab Shell path:		/opt/gitlab/embedded/service/gitlab-shell
Git:		/opt/gitlab/embedded/bin/git

Results of GitLab application Check

Checking GitLab subtasks ...

Checking GitLab Shell ...

GitLab Shell: ... GitLab Shell version >= 11.0.0 ? ... OK (11.0.0)
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Internal API available: OK
Redis available via internal API: OK
gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Gitaly ...

Gitaly: ... default ... OK
storage1 ... OK

Checking Gitaly ... Finished

Checking Sidekiq ...

Sidekiq: ... Running? ... yes
Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished

Checking Incoming Email ...

Incoming Email: ... Reply by email is disabled in config/gitlab.yml

Checking Incoming Email ... Finished

Checking LDAP ...

LDAP: ... Server: ldapmain
LDAP authentication... Success
LDAP users with access to your GitLab server (only showing the first 100 results)
	User output sanitized. Found 100 users of 100 limit.

Checking LDAP ... Finished

Checking GitLab App ...

Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... yes
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
Projects have namespace: ...
2/1 ... yes
3/2 ... yes
8/3 ... yes
4/4 ... yes
4/5 ... yes
4/7 ... yes
4/12 ... yes
3/14 ... yes
3/15 ... yes
4/16 ... yes
4/19 ... yes
4/20 ... yes
4/21 ... yes
4/22 ... yes
4/23 ... yes
4/24 ... yes
4/25 ... yes
4/28 ... yes
35/29 ... yes
36/30 ... yes
36/31 ... yes
35/32 ... yes
36/33 ... yes
36/34 ... yes
4/35 ... yes
4/36 ... yes
4/38 ... yes
4/40 ... yes
40/41 ... yes
4/42 ... yes
43/43 ... yes
42/44 ... yes
41/45 ... yes
4/46 ... yes
4/47 ... yes
48/48 ... yes
48/49 ... yes
48/50 ... yes
48/51 ... yes
48/52 ... yes
48/53 ... yes
48/54 ... yes
48/55 ... yes
48/56 ... yes
48/57 ... yes
48/58 ... yes
48/59 ... yes
48/60 ... yes
48/61 ... yes
48/62 ... yes
48/63 ... yes
48/64 ... yes
48/65 ... yes
48/66 ... yes
48/67 ... yes
48/68 ... yes
48/69 ... yes
48/70 ... yes
49/71 ... yes
49/72 ... yes
4/73 ... yes
35/76 ... yes
4/77 ... yes
4/78 ... yes
49/79 ... yes
10/80 ... yes
4/81 ... yes
4/86 ... yes
4/88 ... yes
4/89 ... yes
4/90 ... yes
4/91 ... yes
43/92 ... yes
4/104 ... yes
4/105 ... yes
4/106 ... yes
53/107 ... yes
43/108 ... yes
36/109 ... yes
4/111 ... yes
41/143 ... yes
4/157 ... yes
4/158 ... yes
4/161 ... yes
46/162 ... yes
4/163 ... yes
46/171 ... yes
46/172 ... yes
46/210 ... yes
41/225 ... yes
43/226 ... yes
43/227 ... yes
4/228 ... yes
4/229 ... yes
4/230 ... yes
4/232 ... yes
41/233 ... yes
53/238 ... yes
43/240 ... yes
41/241 ... yes
41/244 ... yes
46/245 ... yes
4/246 ... yes
4/247 ... yes
4/248 ... yes
4/250 ... yes
4/251 ... yes
4/252 ... yes
4/253 ... yes
46/254 ... yes
66/255 ... yes
36/256 ... yes
4/257 ... yes
4/262 ... yes
4/271 ... yes
4/277 ... yes
4/278 ... yes
4/280 ... yes
4/281 ... yes
4/290 ... yes
4/291 ... yes
36/293 ... yes
36/294 ... yes
36/295 ... yes
4/296 ... yes
4/297 ... yes
46/298 ... yes
4/299 ... yes
46/300 ... yes
43/301 ... yes
46/302 ... yes
4/303 ... yes
46/304 ... yes
59/305 ... yes
46/306 ... yes
4/307 ... yes
4/308 ... yes
46/309 ... yes
46/310 ... yes
85/311 ... yes
4/313 ... yes
4/314 ... yes
4/315 ... yes
4/317 ... yes
46/318 ... yes
4/319 ... yes
4/320 ... yes
88/321 ... yes
4/322 ... yes
4/323 ... yes
4/324 ... yes
4/325 ... yes
4/326 ... yes
4/327 ... yes
4/328 ... yes
41/330 ... yes
4/331 ... yes
41/332 ... yes
4/334 ... yes
4/335 ... yes
4/336 ... yes
4/337 ... yes
4/338 ... yes
46/339 ... yes
4/341 ... yes
41/342 ... yes
41/343 ... yes
41/344 ... yes
41/345 ... yes
88/346 ... yes
46/347 ... yes
4/348 ... yes
43/349 ... yes
4/350 ... yes
4/351 ... yes
4/352 ... yes
88/355 ... yes
4/356 ... yes
46/357 ... yes
93/359 ... yes
88/364 ... yes
46/366 ... yes
46/368 ... yes
41/370 ... yes
41/371 ... yes
4/374 ... yes
4/375 ... yes
4/376 ... yes
4/378 ... yes
4/379 ... yes
4/380 ... yes
4/381 ... yes
4/382 ... yes
4/383 ... yes
4/384 ... yes
4/385 ... yes
4/386 ... yes
4/387 ... yes
4/388 ... yes
66/389 ... yes
46/391 ... yes
4/392 ... yes
41/393 ... yes
4/394 ... yes
4/395 ... yes
46/397 ... yes
41/399 ... yes
4/400 ... yes
4/401 ... yes
4/402 ... yes
103/403 ... yes
4/405 ... yes
4/406 ... yes
4/407 ... yes
41/408 ... yes
46/409 ... yes
66/410 ... yes
46/411 ... yes
46/412 ... yes
41/413 ... yes
4/414 ... yes
49/415 ... yes
69/416 ... yes
46/417 ... yes
46/418 ... yes
41/419 ... yes
4/420 ... yes
4/421 ... yes
4/422 ... yes
4/423 ... yes
4/424 ... yes
4/425 ... yes
4/426 ... yes
4/427 ... yes
4/428 ... yes
46/429 ... yes
4/430 ... yes
4/431 ... yes
4/432 ... yes
4/433 ... yes
4/434 ... yes
4/435 ... yes
41/436 ... yes
4/437 ... yes
4/438 ... yes
4/439 ... yes
4/440 ... yes
4/441 ... yes
41/442 ... yes
4/443 ... yes
4/444 ... yes
4/445 ... yes
4/446 ... yes
4/447 ... yes
4/448 ... yes
4/449 ... yes
4/450 ... yes
36/451 ... yes
41/452 ... yes
41/453 ... yes
Redis version >= 2.8.0? ... yes
Ruby version >= 2.5.3 ? ... yes (2.6.5)
Git version >= 2.22.0 ? ... yes (2.24.1)
Git user has default SSH configuration? ... yes
Active users: ... 66
Is authorized keys file accessible? ... yes
Elasticsearch version 5.6 - 6.x? ... skipped (elasticsearch is disabled)

Checking GitLab App ... Finished


Checking GitLab subtasks ... Finished

Possible fixes

N/A