Mika<p>It's pretty stupid that you could neither name a <a href="https://sakurajima.social/tags/GPG" rel="nofollow noopener noreferrer" target="_blank">#GPG</a> key registered to <a href="https://sakurajima.social/tags/GitLab" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a>, or see which may have expired. My key has expired, I've renewed it locally, and now am updating it on both <a href="https://sakurajima.social/tags/GitHub" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a><span> and GitLab.<br><br>On GH, it's easy to know which key I'd have to replace since it lets you know which of them has expired, and when registering it for the first time, you have to give it an identifier. On GL, there's no (human) identifier whatsoever, and it doesn't tell you which of them has expired either.<br><br>Better find a way to identify it correctly tho or you might risk deleting the wrong GPG key, and potentially cause your verified commits to be deemed unverified.<br><br>---<br><br>Edit: Figured it out. When you list your GPG key on your system like this:<br></span></p><pre><code>gpg --list-secret-keys --keyid-format long</code></pre><span><br>and get something like this:<br></span><pre><code>/home/user/.gnupg/pubring.kbx
------------------------------
sec ed25519/1H89FHO4MGAJTJ9Z 2024-01-15 [SC] [expires: 2026-01-15]
0A41C9F6335DBF47A1A186FAC82F22229FCCE1BF</code></pre><span><br>While on GH, you can identify your key either through the 1) name you gave it or 2) the "short key" i.e. </span><code>1H89FHO4MGAJTJ9Z</code>, on GL you identify it through its "long key" i.e. <code>0A41C9F6335DBF47...</code><span>.<br><br>Likewise, on GH, it </span><i>tags</i> each "Key ID" and "Subkey" as <code>Expired</code> if they're expired - easy enough to understand, meanwhile on GL, it tags valid, non-expired keys as <code>Verified</code>, which may be somewhat confusing or vague.. especially when users coming into this setting is either adding a new GPG key or renewing an outdated one.<p></p>