gpg docs: explain better use of ssh.defaultKeyCommand
Using `ssh-add -L` for gpg.ssh.defaultKeyCommand is not a good recommendation. It might switch keys depending on the order of known keys and it only supports ssh-* and no ecdsa or other keys. Clarify that we expect a literal key prefixed by `key::`, give valid example use cases and refer to `user.signingKey` as the preferred option. Signed-off-by: Fabian Stelzer <fs@gigacodes.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Fabian Stelzer committed
Jun 8, 2022 at 17:24 UTC
ce18a30bb78720d90df42b9d9ee6b8b7dd33d7e6
1 file changed
+6
-3
Documentation/config/gpg.txt
+6
-3
@@ -36,9 +36,12 @@ gpg.minTrustLevel::
36
37
gpg.ssh.defaultKeyCommand::
38
This command that will be run when user.signingkey is not set and a ssh
39
- signature is requested. On successful exit a valid ssh public key is
40
- expected in the first line of its output. To automatically use the first
41
- available key from your ssh-agent set this to "ssh-add -L".
39
+ signature is requested. On successful exit a valid ssh public key
40
+ prefixed with `key::` is expected in the first line of its output.
41
+ This allows for a script doing a dynamic lookup of the correct public
42
+ key when it is impractical to statically configure `user.signingKey`.
43
+ For example when keys or SSH Certificates are rotated frequently or
44
+ selection of the right key depends on external factors unknown to git.
45
46
gpg.ssh.allowedSignersFile::
47
A file containing ssh public keys which you are willing to trust.