Describe the bug

Commits GPG signed by Flux are rejected by the GitLab "Reject unsigned commits" Push Rule even though the signatures show as Verified when the rule is disabled.

To Reproduce

Steps to reproduce the behaviour:

1. Install Flux with an appropriate user SSH private key and GPG private key
2. Add a HelmRelease with the fluxcd.io/automated: true annotation and an appropriate glob pattern pointing at a GitLab EE repo with the "Committer restriction", "Reject unsigned commits" and "Check whether author is a GitLab user" Push Rules enabled
3. Wait for the initial version to deploy
4. Push a new version of the image to the registry

Expected behavior

Flux updates the image.tag value, commits with a signature and pushes successfully to GitLab

Logs

flux-fluxtest-54555f9888-kpr9p flux ts=2020-03-10T15:05:41.66914859Z caller=loop.go:145 component=sync-loop jobID=84c18f9c-2763-9cf1-2161-4de495d9c42c state=done success=false err="git push git@gitlab-server:group/repo.git [master refs/notes/flux]: failed to push some refs to 'git@gitlab-server:group/repo.git', full output:\n remote: GitLab: Commit must be signed with a GPG key \nTo gitlab-server:group/repo.git\n ! [remote rejected] master -> master (pre-receive hook declined)\n ! [remote rejected] refs/notes/flux -> refs/notes/flux (pre-receive hook declined)\nerror: failed to push some refs to 'git@gitlab-server:group/repo.git'\n"

Additional context

• Flux version: 1.17.1
• Kubernetes version: v1.14.9-eks-502bfb
• Git provider: Gitlab 12.7.0-ee
• Container registry provider: Nexus OSS 3.18.1-01