# Which GitRepository setting makes Flux check that the tag it checks out was signed with a trusted PGP key?

Flux CD, Hard (Expert), Security. https://k8wiz.com/uquiz/which-gitrepository-setting-makes-flux-check-that-the-tag-it-checks-out-was-signed-with-a-trusted-pgp-key

- A. spec.verify.mode: Tag, with a secretRef to the public keys
- B. spec.ref.tag together with a signed: true field under spec.ref
- C. spec.verify.mode: HEAD, using the deploy key
- D. spec.ignore with a pattern for unsigned tags

**Answer:** spec.verify.mode: Tag, with a secretRef to the public keys

**Explanation:** verify.mode chooses what to check: HEAD checks the commit that was checked out, Tag checks the tag object, and TagAndHEAD checks the tag and the commit it points to. The Secret holds the trusted public keys. If verification fails, no new revision reaches the cluster.