On Tue, Oct 16, 2012 at 9:30 PM, Patrick Lauer <patr...@gentoo.org> wrote: > That's nice. Can we also add some basic policies on key format (key > length, validity) and get a centrally-hosted keyring? > > Then it'd even make sense for us to start using the whole signing thing > now :)
Well, if we're going to do that give some thought to also whether the sigs need to be by Gentoo devs, and also think about any implications of the move to git. That is, unless we want to just go through all of that all over again. PKI becomes a nightmare if anybody but devs sign, and when we move to git it won't really be possible to have anybody else sign anyway unless we allow merge commits, which is just a whole different mess. The trustees are already wrestling with what to do about non-dev foundation members who lose their gpg keys and thus can't sign ballots or prove who they are. (Let's not do that debate in this thread - just an example of the PKI problem. If you have any concerns either send them to trustees@ or gentoo-nfp and keep them off this list.) Rich
