sbp commented on issue #1417: URL: https://github.com/apache/tooling-trusted-releases/issues/1417#issuecomment-4993784462
The current fix (0c6c7630b35fdb130180c8061edebed95fa80062) only checks primary signing keys, not subkeys, which can have independent expirations. Lack of treatment of subkeys is a problem throughout ATR in general, and something that I've been meaning to revisit for ages, so we may want to create another issue for improved subkey visibility and management, but meanwhile the present issue still continues for subkeys. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
