Re: [PATCH v7 0/9] ssh signing: Add commit & tag signing/verification via SSH keys using ssh-keygen

"Fabian Stelzer via GitGitGadget" [off-list ref] writes:

openssh 8.7 will add valid-after, valid-before options to the allowed keys
keyring. This allows us to pass the commit timestamp to the verification
call and make key rollover possible and still be able to verify older
commits. Set valid-after to the current date when adding your key to the
keyring and set valid-before to make it fail if used after a certain date.
Software like gitolite/github or corporate automation can do this
automatically when ssh push keys are addded / removed I will add this
feature in a follow up patch afterwards.

Has this follow-on work happened already?

The previous rounds saw enough reviews and responses, but this round
didn't.  Usually no response means no interest from the community,
but let's see if somebody other than the author actually tried the
feature, and and want to tell us about their experience, either
positive or negative?

As the basic step of the topic, possibly to be built upon laster, I
am tempted to say that this v7 may want to be cooked in 'next' for
wider exposure.

I'll typofix the topmost commit before doing so, though.

Thanks.



1:  4ff5911494 ! 1:  b88bcd013b ssh signing: test that gpg fails for unkown keys
    @@ Metadata
     Author: Fabian Stelzer [off-list ref]
     
      ## Commit message ##
    -    ssh signing: test that gpg fails for unkown keys
    +    ssh signing: test that gpg fails for unknown keys
     
         Test that verify-commit/tag will fail when a gpg key is completely
         unknown. To do this we have to generate a key, use it for a signature