Re:What does a PGP signature on a Git commit prove?
by waynesonfire on Wednesday March 31, 2021 @08:46AM
(#26646544)
> You want to check the validity of a commit at the moment you use it, not the moment the commit was made
If you received the repo before the key expired, you can still trust the signature even if the key has since expired, as the key was valid at that time the repo was signed.
> imagine I put up a fake tree, with a fake commit with you as an author but made with a fake key that already expired
Yes, you cant trust a key after after it's expiration. See bottom of https://www.kernel.org/signature.html for how the kernel.org folks handled this in 2011. Once they re-signed the release, it's safe to trust the compromised key within that release.
> I don't understand what's the link with the rest of the discussion
We're discussing complexity of pgp adoption, security cards simplify the usage of pgp, thought it was relevant.
If you received the repo before the key expired, you can still trust the signature even if the key has since expired, as the key was valid at that time the repo was signed.
> imagine I put up a fake tree, with a fake commit with you as an author but made with a fake key that already expired
Yes, you cant trust a key after after it's expiration. See bottom of https://www.kernel.org/signature.html for how the kernel.org folks handled this in 2011. Once they re-signed the release, it's safe to trust the compromised key within that release.
> I don't understand what's the link with the rest of the discussion
We're discussing complexity of pgp adoption, security cards simplify the usage of pgp, thought it was relevant.