GPG signing fails in IDE on macOS with: fatal: failed to write commit object error

Problem

When attempting to commit changes with GPG signing enabled in a JetBrains IDE, the operation fails. The IDE might prompt for a GPG passphrase even if the key does not have one. Hitting Enter without a passphrase results in errors in the Git console:

error: gpg failed to sign the data
fatal: failed to write commit object

In some cases, the preceding line in the console is gpg: signing failed: No pinentry even though pinentry-program is set to a graphical pinentry that works in other environments (for example, from the command line).

Committing and signing using Git from the command line works without issues.

Cause

The issue often stems from the GPG agent (gpg-agent) being configured to use a pinentry program that lacks a graphical interface (e.g., pinentry-tty). JetBrains IDEs require a graphical pinentry program (like pinentry-mac on macOS) to interact correctly with the GPG agent for signing operations, even when no passphrase input is needed.

When pinentry-program is already set correctly, the same No pinentry error can appear because the IDE was launched from Finder, Dock, or Spotlight and does not inherit the shell PATH or GPG_TTY. The graphical pinentry cannot start, and gpg-agent reports No pinentry.

Resolution

Configure gpg-agent to use a graphical pinentry program. If Homebrew on macOS is used - pinentry-mac is typically the correct program.

1. Locate and edit the GPG agent configuration file: Open the gpg-agent.conf file located in GnuPG home directory (usually ~/.gnupg/gpg-agent.conf). If the file doesn't exist, create it.

2. Set the pinentry-program path: Add or modify the pinentry-program line to point to the path of the graphical pinentry executable. For a standard Homebrew installation on Apple Silicon macOS, this is typically:

   pinentry-program /opt/homebrew/bin/pinentry-mac
   

   Note: If Homebrew is installed to a different prefix (e.g., /usr/local/bin on Intel Macs) or a different package manager is used (like MacPorts), adjust the path accordingly.

3. Save the configuration file.

4. Restart the GPG agent: Apply the changes by reloading the agent. Open the terminal and run:

   gpg-connect-agent reloadagent /bye
   

   Alternatively, kill the running gpg-agent process; it will restart automatically when needed.

5. Restart your JetBrains IDE.

After completing these steps, GPG commit signing within the IDE should function as expected.

If pinentry-program is already configured correctly

If the above configuration is already in place and the No pinentry error persists, the IDE process does not have the environment that gpg-agent needs to launch the pinentry. On macOS, applications started from Finder, Dock, or Spotlight do not inherit the user shell PATH or GPG_TTY.

Launch the IDE from a terminal to confirm:

open -a "IntelliJ IDEA"

If signing works from this launch, persist the environment for GUI launches: start the IDE from an interactive shell with open -a, or set PATH and GPG_TTY for the user launchd session so GUI applications inherit them.