{"thread":{"id":"29303","subject":"Managing signed git tags and expiring keys","startedAt":"2012-01-06T08:13:00Z","lastAt":"2012-01-06T20:09:24Z","messageCount":2,"participants":["Jonathan \"Duke\" Leto","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"182014","messageId":"CABQG1aSY53-Z73CiUf2kstfaKLJ8zBGzu51CFdWHGiVR16JJ7w@mail.gmail.com","threadId":"29303","inReplyTo":null,"subject":"Managing signed git tags and expiring keys","fromName":"Jonathan \"Duke\" Leto","fromEmail":"jonathan@leto.net","sentAt":"2012-01-06T08:13:00Z","receivedAt":"2012-01-06T08:13:00Z","isPatch":false,"sender":{"key":"jonathan@leto.net","avatar":"https://avatars.githubusercontent.com/u/30298?v=4"},"body":"Howdy,\n\nMy question is about the Git workflow in a repository which has signed\ntags and uses expiring keys in a chain of trust.\n\nWhen the key changes, all existing tags are signed with the previous\nkey in the chain of trust.\n\nDo people:\n1) resign all the tags, causing people to overwrite their local tags\n2) keep all versions of the keys in the chain of trust\n3) something else more involved?\n\nIs anybody doing this currently?\n\nThanks!\n\nDuke\n\n-- \nJonathan \"Duke\" Leto <jonathan@leto.net>\nLeto Labs LLC\n209.691.DUKE // http://labs.leto.net\nNOTE: Personal email is only checked twice a day at 10am/2pm PST,\nplease call/text for time-sensitive matters.\n"},{"id":"182039","messageId":"7vk454k2yz.fsf@alter.siamese.dyndns.org","threadId":"29303","inReplyTo":"CABQG1aSY53-Z73CiUf2kstfaKLJ8zBGzu51CFdWHGiVR16JJ7w@mail.gmail.com","subject":"Re: Managing signed git tags and expiring keys","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2012-01-06T20:09:24Z","receivedAt":"2012-01-06T20:09:24Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Jonathan \\\"Duke\\\" Leto\" <jonathan@leto.net> writes:\n\n> When the key changes, all existing tags are signed with the previous\n> key in the chain of trust.\n>\n> Do people:\n> 1) resign all the tags, causing people to overwrite their local tags\n> 2) keep all versions of the keys in the chain of trust\n> 3) something else more involved?\n>\n> Is anybody doing this currently?\n\nMany kernel.org users (Linus and myself included) changed their signing\nkeys last year, so their project histories have tags signed with different\nkeys. I highly doubt anybody revoked old key and re-signed his tags with\nnew one.\n"}]}