1 |
On Wed, Dec 16, 2020 at 3:01 AM Michał Górny <mgorny@g.o> wrote: |
2 |
> |
3 |
> On Tue, 2020-12-15 at 23:37 -0500, Aaron W. Swenson wrote: |
4 |
> > On 2020-12-15 11:16, Michael Orlitzky wrote: |
5 |
> > > On 12/15/20 11:11 AM, Thomas Deutschmann wrote: |
6 |
> > > > |
7 |
> > > > What do you mean exactly? |
8 |
> > > > |
9 |
> > > > For Gentoo tooling, only Gentoo keyservers are important and |
10 |
> > > > Gentoo no longer synchronizes with any other pool. |
11 |
> > > > |
12 |
> > > "The Gentoo developer tooling explicitly checks the Gentoo |
13 |
> > > keyserver |
14 |
> > > pool with a much higher frequency" strongly implies that we check |
15 |
> > > the |
16 |
> > > non-Gentoo pools with a non-zero frequency. |
17 |
> > > |
18 |
> > > |
19 |
> > |
20 |
> > I'm with Michael on this. I've recently experienced this issue myself |
21 |
> > as the |
22 |
> > instruction to upload the key to the Gentoo keyserver is separate |
23 |
> > from the |
24 |
> > GLEP63[1] document. It doesn't matter that the step is documented if |
25 |
> > the Holy |
26 |
> > Tome GLEP63 doesn't mention it. What hint would I have to look for a |
27 |
> > supplemental document to provide that specific step? |
28 |
> > |
29 |
> > According to GLEP 63, uploading to the SKS keyserver is a |
30 |
> > requirement. |
31 |
> > However, it fails to specify which SKS keyserver. In fact, neither |
32 |
> > "SKS" nor |
33 |
> > "keyserver" are defined in GLEP63. Ergo, the natural interpretation |
34 |
> > is *anything* |
35 |
> > that's called an SKS keyserver will satisfy the requirement. As long |
36 |
> > as the |
37 |
> > developer can submit the key, the requirement is met. |
38 |
> > |
39 |
> > Additionally, the supplemental document[2] doesn't say developers |
40 |
> > must upload |
41 |
> > via an internal host, but that devs should upload to both SKS and the |
42 |
> > Gentoo |
43 |
> > keyserver. Yes, it says the Gentoo keyserver is currently restricted |
44 |
> > to syncing |
45 |
> > with "authorized Gentoo hosts", but that's a nonsense phrase and |
46 |
> > unhelpful. It |
47 |
> > assumes I know what the authorized Gentoo hosts are. It doesn't |
48 |
> > clearly state |
49 |
> > what they are. It kind of hints that it will pull from SKS |
50 |
> > eventually, but it |
51 |
> > could take a long time. |
52 |
> > |
53 |
> > I understand we temporarily stopped syncing with the public keyserver |
54 |
> > out of an |
55 |
> > overabundance of caution. However, that shouldn't have been done |
56 |
> > without |
57 |
> > updating every official Gentoo resource regarding how devs should |
58 |
> > handle their |
59 |
> > keys, which as far as I know is only two documents[1,2]. A whopping 2 |
60 |
> > documents. |
61 |
> > |
62 |
> > This new (I know it's been around for a year but that doesn't make it |
63 |
> > any less |
64 |
> > new), stricter requirement, should be **explicitly** stated in |
65 |
> > GLEP63, properly |
66 |
> > referencing the justification[3], and linking to the infra |
67 |
> > supplemental |
68 |
> > document. The infra supplemental document needs to then use the |
69 |
> > phrase "must" in |
70 |
> > place of "should" when informing readers to upload to two different |
71 |
> > locations. |
72 |
> |
73 |
> ...and what have you done to resolve the problem, except for making |
74 |
> oververbose complaints and demands in middle of some random thread? |
75 |
|
76 |
If you think he's being unhelpful, maybe suggest ways of contributing |
77 |
that would be more helpful. There's no need for this snippy reply. |