gpg: signing failed: Inappropriate ioctl for device

gpg prints gpg: signing failed: Inappropriate ioctl for device when it needs your key's passphrase but its pinentry program cannot open the terminal. The usual fix is to tell gpg-agent which terminal to use by setting GPG_TTY.

Fix: set GPG_TTY

echo 'export GPG_TTY=$(tty)' >> ~/.bashrc   # or ~/.zshrc
export GPG_TTY=$(tty)
echo test | gpg --clearsign >/dev/null && echo "signing works"

The GnuPG manual asks for this line in the shell's startup file, because gpg-agent's terminal pinentry needs to know the current tty.

Fix: use a graphical pinentry

When gpg runs from an IDE or a GUI Git client, there is no terminal at all. Point gpg-agent at a graphical pinentry:

pinentry-program /usr/bin/pinentry-gnome3

On macOS, pinentry-mac (Homebrew) is the usual choice. Restart the agent after changing the file:

gpgconf --kill gpg-agent

Signing Git commits

git config --global user.signingkey <KEY-ID>
git config --global commit.gpgsign true
git commit -S -m "signed commit"

If git commit -S fails with this error, run echo test | gpg --clearsign in the same shell: if that fails too, the problem is gpg, not git.

FAQ