# v1alpha1SourceIntegrityGitPolicy

Type: object

Schema: [v1alpha1SourceIntegrityGitPolicy](https://sourcey-argocd.pages.dev/api/models/v1alpha1sourceintegritygitpolicy/index.md)

- `gpg` (optional)
  Reference: [v1alpha1SourceIntegrityGitPolicyGPG](https://sourcey-argocd.pages.dev/api/models/v1alpha1sourceintegritygitpolicygpg/index.md); Type: object
  
  SourceIntegrityGitPolicyGPG verifies that the commit(s) are both correctly signed by a key in the repo-server keyring,
  and that they are signed by one of the key listed in Keys.
  
  This policy can be deactivated through the ARGOCD_GPG_ENABLED environment variable.
  
  Note the listing of problematic commits/signatures reported when "strict" mode validation fails may not be complete.
  This means that a user that has addressed all problems reported by source integrity check can run into
  further problematic signatures on a subsequent attempt. That happens namely when history contains seal commits signed
  with gpg keys that are in the keyring, but not listed in Keys.

- `repos` (optional)
  Type: array
  
  Items:
    Reference: [v1alpha1SourceIntegrityGitPolicyRepo](https://sourcey-argocd.pages.dev/api/models/v1alpha1sourceintegritygitpolicyrepo/index.md); Type: object