# v1alpha1SourceIntegrityGitPolicyGPG

Type: object

SourceIntegrityGitPolicyGPG verifies that the commit(s) are both correctly signed by a key in the repo-server keyring,
and that they are signed by one of the key listed in Keys.

This policy can be deactivated through the ARGOCD_GPG_ENABLED environment variable.

Note the listing of problematic commits/signatures reported when "strict" mode validation fails may not be complete.
This means that a user that has addressed all problems reported by source integrity check can run into
further problematic signatures on a subsequent attempt. That happens namely when history contains seal commits signed
with gpg keys that are in the keyring, but not listed in Keys.

Schema: [v1alpha1SourceIntegrityGitPolicyGPG](https://sourcey-argocd.pages.dev/api/models/v1alpha1sourceintegritygitpolicygpg/index.md)

- `keys` (optional)
  Type: array
  
  List of key IDs to trust. The keys need to be in the repository server keyring.
  
  Items:
    Type: string

- `mode` (optional)
  Type: string