In the past signing other OpenPGP keys that expire at a certain date caused
the following prompt:
| This key is due to expire on 2012-12-10. |
| Do you want your signature to expire at the same time? (Y/n) |
In http://www.mail-archive.com/gnupg-users@gnupg.org/msg01109.html
Peter Palfrader reported that using --no-ask-cert-expire does not
disable this question, in
http://www.mail-archive.com/gnupg-users@gnupg.org/msg01128.html
David Shaw answered that he corrected this for for 1.4.2.
Corresponding changelog entry:
2005-07-22 David Shaw <dshaw@jabberwocky.com>
- keyedit.c (sign_uids): Don't prompt for setting signature expiry to match key expiry unless --ask-cert-expire is set. Suggested by Peter Palfrader.
Change is in SVN r3829:
http://cvs.gnupg.org/cgi-bin/viewcvs.cgi?view=rev&revision=3829
The changed behaviour has benefits, because people can extend the expiry
time of their keys without having to ask previous signers to repeat
their signature, but this represents a problem if e.g. people sign the
key of a temporary employee (e.g. internship for 3 months). The key may
have a very short lifetime and therefore the key never gets explicitly
revoked. Now the intern leaves the company, extends the expiry time of
the key he took with him and still has valid signatures of his former
bosses and co-workers on the company email address.
Requiring "ask-cert-expire" is different from what making
"no-ask-cert-expire" work and I did not find any other discussion about
this topic, so I assume that the change was done without discussing this
problem.
Additionally maybe "no-ask-cert-expire" should only refer to the prompt:
| Please specify how long the signature should be valid. |
| 0 = signature does not expire |
| <n> = signature expires in n days |
| <n>w = signature expires in n weeks |
| <n>m = signature expires in n months |
| <n>y = signature expires in n years |
| Signature is valid for? (0) |
and not to:
| This key is due to expire on yyyy-mm-dd. |
| Do you want your signature to expire at the same time? (Y/n) |
gpg2 is affected, too, tested with 2.0.14.