| 1 |
On Thu, Dec 17, 2020 at 01:12:16PM -0500, Mike Gilbert wrote: |
| 2 |
>Signed-off-by: Mike Gilbert <floppym@g.o> |
| 3 |
>--- |
| 4 |
> |
| 5 |
>v2: Added "This upload is required in addition to uploading the SKS pool." |
| 6 |
> |
| 7 |
> glep-0063.rst | 24 ++++++++++++++++++++---- |
| 8 |
> 1 file changed, 20 insertions(+), 4 deletions(-) |
| 9 |
> |
| 10 |
>diff --git a/glep-0063.rst b/glep-0063.rst |
| 11 |
>index 82541bd..ec465db 100644 |
| 12 |
>--- a/glep-0063.rst |
| 13 |
>+++ b/glep-0063.rst |
| 14 |
>@@ -7,10 +7,10 @@ Author: Robin H. Johnson <robbat2@g.o>, |
| 15 |
> Michał Górny <mgorny@g.o> |
| 16 |
> Type: Standards Track |
| 17 |
> Status: Final |
| 18 |
>-Version: 2.1 |
| 19 |
>+Version: 2.2 |
| 20 |
> Created: 2013-02-18 |
| 21 |
>-Last-Modified: 2019-11-07 |
| 22 |
>-Post-History: 2013-11-10, 2018-07-03, 2018-07-21, 2019-02-24 |
| 23 |
>+Last-Modified: 2020-12-17 |
| 24 |
>+Post-History: 2013-11-10, 2018-07-03, 2018-07-21, 2019-02-24, 2020-12-17 |
| 25 |
> Content-Type: text/x-rst |
| 26 |
> --- |
| 27 |
> |
| 28 |
>@@ -28,6 +28,9 @@ OpenPGP key management policies for the Gentoo Linux distribution. |
| 29 |
> Changes |
| 30 |
> ======= |
| 31 |
> |
| 32 |
>+v2.2 |
| 33 |
>+ Added "Gentoo Keyserver" section under "Gentoo Infrastructure" chapter. |
| 34 |
>+ |
| 35 |
> v2.1 |
| 36 |
> A requirement for an encryption key has been added, in order to extend |
| 37 |
> the GLEP beyond commit signing and into use of OpenPGP for dev-to-dev |
| 38 |
>@@ -135,8 +138,11 @@ their primary key). |
| 39 |
> |
| 40 |
> 5. Encrypted backup of your secret keys. |
| 41 |
> |
| 42 |
>+Gentoo Infrstructure |
| 43 |
>+==================== |
| 44 |
>+ |
| 45 |
> Gentoo LDAP |
| 46 |
>-=========== |
| 47 |
>+----------- |
| 48 |
> |
| 49 |
> All Gentoo developers must list the complete fingerprint for their primary |
| 50 |
> keys in the "``gpgfingerprint``" LDAP field. It must be exactly 40 hex digits, |
| 51 |
>@@ -147,6 +153,16 @@ of the fingerprint field. In any place that presently displays |
| 52 |
> the "``gpgkey``" field, the last 16 hex digits of the fingerprint should |
| 53 |
> be displayed instead. |
| 54 |
> |
| 55 |
>+Gentoo Keyserver |
| 56 |
>+---------------- |
| 57 |
>+ |
| 58 |
>+Gentoo infrastructure uses a keyserver that is isolated from the SKS pool. |
| 59 |
>+This keyserver is restricted to accepting uploads from authorized Gentoo hosts. |
| 60 |
>+A script is provided on dev.gentoo.org to allow developers to upload their |
| 61 |
>+keys. This upload is required in addition to uploading to the SKS pool. |
| 62 |
>+ |
| 63 |
>+``gpg --export KEYID | ssh dev.gentoo.org /usr/local/bin/openpgp-key-upload`` |
| 64 |
>+ |
| 65 |
> Backwards Compatibility |
| 66 |
> ======================= |
| 67 |
> |
| 68 |
>-- |
| 69 |
>2.30.0.rc0 |
| 70 |
> |
| 71 |
> |
| 72 |
|
| 73 |
Thanks for doing this! You beat me to the punch. I was going to try getting to |
| 74 |
it tomorrow. |
| 75 |
|
| 76 |
It may be good to also change step 7 under "Bare minimum requirements" to read: |
| 77 |
|
| 78 |
7. Upload your key to the Gentoo Keyserver before usage! |
| 79 |
|
| 80 |
It'd give skimmers a trigger to look for the Gentoo keyserver info. |
| 81 |
|
| 82 |
We might want to add "Upload to the SKS or some other public PGP pool" under |
| 83 |
"Recommendations", but that's probably beyond the scope of the document now. |
| 84 |
|
| 85 |
Lastly, should we have a link to the step-by-step guide? [1] |
| 86 |
|
| 87 |
[1]: https://wiki.gentoo.org/wiki/Project:Infrastructure/Generating_GLEP_63_based_OpenPGP_keys |
Archives