| 1 |
On January 5, 2017 2:58:26 AM GMT+09:00, Kristian Fiskerstrand <k_f@g.o> wrote: |
| 2 |
>With increasing focus on security in various contexts I'd like to |
| 3 |
>propose that we start discussing catching up with other distributions |
| 4 |
>and start requiring new developers' OpenPGP keyblocks to have at least |
| 5 |
>two signatures from existing developers before applications can be |
| 6 |
>made[A]. Amongst other things This helps building the Gentoo Web of |
| 7 |
>Trust. |
| 8 |
> |
| 9 |
> |
| 10 |
>E.g [Debian] has the following requirement: "To maintain the strong Web |
| 11 |
>of Trust that connects all Debian Developers, Applicants need to |
| 12 |
>identify themselves by providing an OpenPGP key that is signed by at |
| 13 |
>least two official Developers. To further ensure their identity, |
| 14 |
>signatures by other people (who do not need to be DDs, but should be |
| 15 |
>well connected in the overall Web of Trust) are strongly recommended." |
| 16 |
> |
| 17 |
|
| 18 |
Debian can work with Web of Trust because of the annual Debconf and/or some local Debian meeting. |
| 19 |
I think Gentoo approaches and objectives are different. |
| 20 |
Gentoo is looking more at the technical skill of the person, not at how much is well connected. |
| 21 |
imho |
| 22 |
|
| 23 |
> |
| 24 |
>References: |
| 25 |
> |
| 26 |
>[Debian] https://www.debian.org/devel/join/nm-checklist |
| 27 |
> |
| 28 |
> |
| 29 |
>Endnotes: |
| 30 |
> |
| 31 |
>[A] Possibly with an opt-out by application to council, in case there |
| 32 |
>are certain regions where this is considered non-feasable etc. |
Archives