Re: [gentoo-dev] Re: rejecting unsigned commits

[Andreas K. Huettel]

> > * The key must have an userid that refers to an official Gentoo
> > e-mail address. E.g. dilfridge@g.o
>
> I think this is pretty useless assuming we're already wanting
> to limit the amount of keys trusted to a specific list.

See the remark in a separate sub-thread about signing...

Deciding key validity based on signatures is a lot better than based on a central list. Otherwise we are just duplicating existing infrastructure.

> > * The userid should have some specific "default string" in its
> > comment field, like "Gentoo manifest signing key".
>
> What's the point of this? I don't see a reason to enforce a dev to have
> a dedicated Manifest signing key, and even more I don't see a reason to
> add such comments to normal keys.

Well it's probably not necessary. It might simplify identification of the UID that determines key validity though.


-- 
Andreas K. Huettel
Gentoo Linux developer - kde, sci, arm, tex
dilfridge@g.o
http://www.akhuettel.de/