From 88e452fdd8366cd0d235f2d49b660c09fdae4e3f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20No=C3=A9=20Ramos=20L=C3=B3pez?= Date: Fri, 30 Oct 2026 02:15:28 -0400 Subject: [PATCH] doc: gpg: say which date SSH key lifetimes are checked against MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The description of gpg.ssh.allowedSignersFile says that Git marks a signature as valid if the signing key was valid at the time of the signature's creation. An SSH signature does not record when it was made, though. When verifying a commit or a tag, Git passes the committer or tagger date to ssh-keygen with -Overify-time, and the valid-after and valid-before options of a key are checked against that date. Say which date is used, and that the signer chooses it. While at it, fix the spelling of "OpenSSH" in the same paragraph. Helped-by: Phillip Wood Helped-by: Junio C Hamano Helped-by: Patrick Steinhardt Signed-off-by: Christian Noé Ramos López Signed-off-by: Junio C Hamano --- Documentation/config/gpg.adoc | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/Documentation/config/gpg.adoc b/Documentation/config/gpg.adoc index 240e46c050..d3713e9600 100644 --- a/Documentation/config/gpg.adoc +++ b/Documentation/config/gpg.adoc @@ -70,10 +70,12 @@ A repository that only allows signed commits can store the file in the repository itself using a path relative to the top-level of the working tree. This way only committers with an already valid key can add or change keys in the keyring. + -Since OpensSSH 8.8 this file allows specifying a key lifetime using valid-after & -valid-before options. Git will mark signatures as valid if the signing key was -valid at the time of the signature's creation. This allows users to change a -signing key without invalidating all previously made signatures. +Since OpenSSH 8.8 this file allows specifying a key lifetime using valid-after & +valid-before options. Git validates the signature by checking the committer or +tagger timestamp is within the validity time range. This does not provide any +security guarantees as the timestamp can be chosen arbitrarily by the signer. +But it allows users to change a signing key without invalidating all previously +made signatures. + Using a SSH CA key with the cert-authority option (see ssh-keygen(1) "CERTIFICATES") is also valid.