| 1 |
On 01/06/2017 01:44 AM, Aaron Bauman wrote: |
| 2 |
> |
| 3 |
> On 01/05/2017 02:58 AM, Kristian Fiskerstrand wrote: |
| 4 |
>> With increasing focus on security in various contexts I'd like to |
| 5 |
>> propose that we start discussing catching up with other distributions |
| 6 |
>> and start requiring new developers' OpenPGP keyblocks to have at least |
| 7 |
>> two signatures from existing developers before applications can be |
| 8 |
>> made[A]. Amongst other things This helps building the Gentoo Web of Trust. |
| 9 |
>> |
| 10 |
>> |
| 11 |
>> E.g [Debian] has the following requirement: "To maintain the strong Web |
| 12 |
>> of Trust that connects all Debian Developers, Applicants need to |
| 13 |
>> identify themselves by providing an OpenPGP key that is signed by at |
| 14 |
>> least two official Developers. To further ensure their identity, |
| 15 |
>> signatures by other people (who do not need to be DDs, but should be |
| 16 |
>> well connected in the overall Web of Trust) are strongly recommended." |
| 17 |
>> |
| 18 |
>> |
| 19 |
>> References: |
| 20 |
>> |
| 21 |
>> [Debian] https://www.debian.org/devel/join/nm-checklist |
| 22 |
>> |
| 23 |
>> |
| 24 |
>> Endnotes: |
| 25 |
>> |
| 26 |
>> [A] Possibly with an opt-out by application to council, in case there |
| 27 |
>> are certain regions where this is considered non-feasable etc. |
| 28 |
>> |
| 29 |
> |
| 30 |
> Thanks for the proposal, Kristian. Overall, I think we do need some more |
| 31 |
> detail (for the masses) and possibly a GLEP drafted with those specifics. |
| 32 |
> |
| 33 |
> Debian's model [1] seems very flexible and retains the ability for |
| 34 |
> developers to be exempted from the process due to extenuating |
| 35 |
> circumstances. There are no intentions of "locking" any one out because |
| 36 |
> of financial or geographical restraints. |
| 37 |
> |
| 38 |
> The concerns about fakes and other avenues of deception are well |
| 39 |
> founded, but as of now Gentoo is wide open anyway. This model will allow |
| 40 |
> us to begin a long process of building the WoT which can only get better |
| 41 |
> if recruitment goes up. It really only makes things *better*. |
| 42 |
> |
| 43 |
> Maybe it will encourage more social interaction as well. I have |
| 44 |
> conferenced with other developers via audio and maybe soon video. Not |
| 45 |
> only does it bring an aspect of personal interaction... it also brings a |
| 46 |
> new level of understanding instead of the textual medium we are all so |
| 47 |
> used to. |
| 48 |
> |
| 49 |
> The ultimate goal here is to build the WoT, as you mentioned, and bring |
| 50 |
> more validity to our tree etc. I would be willing to help draft the GLEP |
| 51 |
> and ensure we meet such intent. |
| 52 |
> |
| 53 |
> -Aaron |
| 54 |
> |
| 55 |
> [1]: https://www.debian.org/events/keysigning |
| 56 |
> |
| 57 |
> |
| 58 |
I'd be willing to help on drafting as well. Keysigning is something I've |
| 59 |
been wanting to get into, and helping Gentoo makes it even better. I |
| 60 |
could look into LUGs near me and see if they'd be receptive to an event |
| 61 |
like that, if only to raise awareness for both PGP and Gentoo. |
| 62 |
|
| 63 |
-- |
| 64 |
Daniel Campbell - Gentoo Developer |
| 65 |
OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net |
| 66 |
fpr: AE03 9064 AE00 053C 270C 1DE4 6F7A 9091 1EA0 55D6 |
Archives