Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?

[Rich Freeman]

On Wed, Jan 4, 2017 at 12:58 PM, Kristian Fiskerstrand <k_f@g.o> wrote:
> With increasing focus on security in various contexts I'd like to
> propose that we start discussing catching up with other distributions
> and start requiring new developers' OpenPGP keyblocks to have at least
> two signatures from existing developers before applications can be
> made[A]. Amongst other things This helps building the Gentoo Web of Trust.
>
>
> E.g [Debian] has the following requirement: "To maintain the strong Web
> of Trust that connects all Debian Developers, Applicants need to
> identify themselves by providing an OpenPGP key that is signed by at
> least two official Developers. To further ensure their identity,
> signatures by other people (who do not need to be DDs, but should be
> well connected in the overall Web of Trust) are strongly recommended."
>

Looking at our developer map this seems incredibly impractical.  I
know I've yet to actually bump into another Gentoo developer.  Sure, I
could fly out to SCALE or FOSDEM (which are about equidistant), but
this seems a bit much for a requirement, even if I'm likely to get
around to it one of these years.

Also, we have fairly specific requirements for our gpg signing keys,
so there is a good chance that any existing keys that candidates have
which bear signatures may not be usable for Gentoo, meaning that
they're starting out from ground zero.  I don't know if the intent is
that the signatures come from keys that meet our gpg key requirements,
but if so that will mean that most candidates will not have an
existing web of trust either.  Personally I met the Gentoo gpg
requirements by just generating a new key used for Gentoo signing
only, and it has no signatures at all.

Sure, it makes sense in an ideal world, but if we're going to go along
this route I think we need to come up with a more practical way of
getting developer signatures than bumping into them at conferences, or
happening to live nearby one.  I'm surprised Debian is able to make it
work, even with their larger developer counts.  I guess it could work
in areas with high concentrations, like Silicon Valley.  Maybe you
could get by with video conferencing and holding up passports/IDs,
though good luck finding a client for that which meets our social
contract and works on a Chromebook.  :)

-- 
Rich