Re: [gentoo-dev] [PATCH v3 10/12] glep-0063: Make 2-yearly expiration term mandatory

[Robin H. Johnson]

On Fri, Jul 06, 2018 at 08:18:32AM +0200, Michał Górny wrote:
> > option a)
> > 2 years + N:
> > 2 weeks <= N <= 3 months.
> >
> > option b)
> > Change the wording to be 'at most 2 years' instead of 'exactly 2 years'.
> That *is* the wording.
I apologize. I took ulm's post as canonical and didn't confirm in the
original GLEP text.

Further change to follow in response to the original text.

> > Separately:
> > Is two weeks enough time for a new key distribution to users?
>
> I originally wanted to specify one month but k_f insisted on something
> shorter.  2 weeks were the compromise we agreed on.  That said, I'd say
> weekly 'gpg --refresh' is what we should recommend as the bare minimum.
>
> That said, the point of two weeks is mostly to give us time to remind
> developers that their key is expiring and to give them time to actually
> read their mail and do it before it actually expires.
Please let's start reminding them BEFORE that. I have seen a lot of
.away files over the last decade, and taking a 2-week offline vacation
does happen.

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@g.o
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136