Skip to content

Commit

Permalink
PGP
Browse files Browse the repository at this point in the history
  • Loading branch information
rarkins committed Apr 21, 2024
1 parent 5936835 commit 893d209
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions docs/usage/self-hosted-configuration.md
Original file line number Diff line number Diff line change
Expand Up @@ -926,7 +926,7 @@ sub rsa4096 2021-09-10 [E]
The private key should then be added to your Renovate Bot global config (either using `privateKeyPath` or exporting it to the `RENOVATE_PRIVATE_KEY` environment variable).
The public key can be used to replace the existing key in <https://app.renovatebot.com/encrypt> for your own use.

Any encrypted secrets using GPG must have a mandatory organization/group scope, and optionally can be scoped for a single repository only.
Any PGP-encrypted secrets must have a mandatory organization/group scope, and optionally can be scoped for a single repository only.
The reason for this is to avoid "replay" attacks where someone could learn your encrypted secret and then reuse it in their own Renovate repositories.
Instead, with scoped secrets it means that Renovate ensures that the organization and optionally repository values encrypted with the secret match against the running repository.

Expand All @@ -941,14 +941,14 @@ Instead, with scoped secrets it means that Renovate ensures that the organizatio
Use this field if you need to perform a "key rotation" and support more than one keypair at a time.
Decryption with this key will be tried after `privateKey`.

If you are migrating from the legacy public key encryption approach to use GPG, then move your legacy private key from `privateKey` to `privateKeyOld` and then put your new GPG private key in `privateKey`.
Doing so will mean that Renovate will first try to decrypt using the GPG key but fall back to the legacy key and try that next.
If you are migrating from the legacy public key encryption approach to use a PGP key, then move your legacy private key from `privateKey` to `privateKeyOld` and then put your new PGP private key in `privateKey`.
Doing so will mean that Renovate will first try to decrypt using the PGP key but fall back to the legacy key and try that next.

You can remove the `privateKeyOld` config option once all the old encrypted values have been migrated, or if you no longer want to support the old key and let the processing of repositories fail.

<!-- prettier-ignore -->
!!! note
Renovate now logs a warning whenever repositories use non-GPG encrypted config variables.
Renovate now logs a warning whenever repositories use non-PGP encrypted config variables.

## privateKeyPath

Expand Down

0 comments on commit 893d209

Please sign in to comment.