diff options
| author |  Junio C Hamano <gitster@pobox.com> | 2021-12-21 15:03:15 -0800 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2021-12-21 15:03:15 -0800 |
| commit | d2f0b7275998ebeaa15e48ce0180c466e1d77ec4 (patch) | |
| tree | 9c78f0d3b6d3ba03fc9e6466f1f56fdc31443fcf /Documentation/config | |
| parent | Merge branch 'jc/grep-patterntype-default-doc' (diff) | |
| parent | ssh signing: verify ssh-keygen in test prereq (diff) | |
| download | tgif-d2f0b7275998ebeaa15e48ce0180c466e1d77ec4.tar.xz | |
Merge branch 'fs/ssh-signing-key-lifetime'
Extend the signing of objects with SSH keys and learn to pay
attention to the key validity time range when verifying.
* fs/ssh-signing-key-lifetime:
ssh signing: verify ssh-keygen in test prereq
ssh signing: make fmt-merge-msg consider key lifetime
ssh signing: make verify-tag consider key lifetime
ssh signing: make git log verify key lifetime
ssh signing: make verify-commit consider key lifetime
ssh signing: add key lifetime test prereqs
ssh signing: use sigc struct to pass payload
t/fmt-merge-msg: make gpgssh tests more specific
t/fmt-merge-msg: do not redirect stderr
Diffstat (limited to 'Documentation/config')
| -rw-r--r-- | Documentation/config/gpg.txt | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/Documentation/config/gpg.txt b/Documentation/config/gpg.txt index 4f30c7dbdd..c9be554c73 100644 --- a/Documentation/config/gpg.txt +++ b/Documentation/config/gpg.txt @@ -64,6 +64,11 @@ A repository that only allows signed commits can store the file in the repository itself using a path relative to the top-level of the working tree. This way only committers with an already valid key can add or change keys in the keyring. + +Since OpensSSH 8.8 this file allows specifying a key lifetime using valid-after & +valid-before options. Git will mark signatures as valid if the signing key was +valid at the time of the signatures creation. This allows users to change a +signing key without invalidating all previously made signatures. ++ Using a SSH CA key with the cert-authority option (see ssh-keygen(1) "CERTIFICATES") is also valid. |