[PATCH v2] doc: gpg: say which date SSH key lifetimes are checked against

["Christian Noé Ramos López" <chris@nortesoftware.dev>]

The description of gpg.ssh.allowedSignersFile says that Git marks a
signature as valid if the signing key was valid at the time of the
signature's creation. An SSH signature does not record when it was
made, though. When verifying a commit or a tag, Git passes the
committer or tagger date to ssh-keygen with -Overify-time, and the
valid-after and valid-before options of a key are checked against
that date.

Say which date is used. While at it, fix the spelling of "OpenSSH"
in the same paragraph.

Helped-by: Phillip Wood <phillip.wood@dunelm.org.uk>
Helped-by: Junio C Hamano <gitster@pobox.com>
Signed-off-by: Christian Noé Ramos López <chris@nortesoftware.dev>
---
Changes since v1: Junio's wording, with "OpenSSH" spelled right. That
drops two sentences asked for in the thread, the one on the time in a
GPG signature (Phillip) and the one on leaked keys (Patrick); say if
you want either back.

 Documentation/config/gpg.adoc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Documentation/config/gpg.adoc b/Documentation/config/gpg.adoc
index 240e46c05..f5bb3cbf3 100644
--- a/Documentation/config/gpg.adoc
+++ b/Documentation/config/gpg.adoc
@@ -70,9 +70,9 @@ A repository that only allows signed commits can store the file
 in the repository itself using a path relative to the top-level of the working tree.
 This way only committers with an already valid key can add or change keys in the keyring.
 +
-Since OpensSSH 8.8 this file allows specifying a key lifetime using valid-after &
-valid-before options. Git will mark signatures as valid if the signing key was
-valid at the time of the signature's creation. This allows users to change a
+Since OpenSSH 8.8 this file allows specifying a key lifetime using valid-after &
+valid-before options. Git validates the signature by checking the committer or
+tagger timestamp is within the validity time range. This allows users to change a
 signing key without invalidating all previously made signatures.
 +
 Using a SSH CA key with the cert-authority option

base-commit: 47fdf2208c5b94c8cc01c106b8f7c85efb91c926
-- 
2.47.3