SSH key expiration lacks automatic revocation policy in Sourcetree

Question

Sourcetree's SSH key management stores private keys in the system keyring or plaintext without built-in expiration or rotation metadata, creating a credential lifecycle gap for environments that enforce least-privilege access policies. When an SSH key expires, the application either prompts for a password or fails the connection, with no automatic revocation or update workflow triggered from within the Manage SSH Keys dialog. Similarly, HTTPS credential helpers can be configured but Sourcetree does not enforce least-privilege token scopes, storing full-access tokens that may exceed required permissions.

This behavior raises questions about how the client can integrate with external identity management systems while maintaining secure, time-bounded access. What mechanisms could Sourcetree adopt to surface credential expiration status? Should the key management interface incorporate validity periods? How should HTTPS token scopes be constrained without disrupting existing repository workflows?

Tasadduq Burney · Answer

Answer
Sourcetree lacks an automatic revocation policy for SSH keys; it stores private keys in the OS keyring or plain files without any expiration metadata, so when a key’s validity period ends the client either prompts for a password or fails the connection, providing no built‑in revocation.
Explanation: The Manage SSH Keys dialog does not display key validity dates, and there is no mechanism for the application to detect an expired key without external metadata. Consequently, credential lifecycle management must be handled outside the UI.
Steps to verify and address the gap:

Inspect the stored key file or keyring entry for a timestamp field; if none exists, add a custom header line with an expiration date.
Confirm the key’s expiration date using the OS keyring or file modification time.
Update Sourcetree (if a newer version exposes key metadata APIs) or implement a script that checks the expiration date before each SSH operation.
Configure HTTPS token scopes by switching from full‑access tokens to scoped tokens that are validated against required permissions.

Missing diagnostic: Does your Sourcetree version allow custom metadata (e.g., a header line) in the stored SSH key files to indicate an expiration timestamp?

SSH key expiration lacks automatic revocation policy in Sourcetree

1 answer

Answer

Your perspective belongs here.

0 question comments