Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?

[Daniel Campbell]

On 01/06/2017 01:49 PM, William L. Thomson Jr. wrote:
> There isn't a real need for OpenGPG signatures on applications

I disagree. Becoming a Gentoo developer gives you a key to a clubhouse,
so to speak. We need to be sure that we're trusting exactly one person
(in this case, a GPG/SSH key) and granting them access. It keeps
Gentoo's Web of Trust a little better managed, as it limits vulnerability.

That said: sure, there's nothing stopping a group from using a single
key, but they'd have to be incredibly well-coordinated and agree on
practically all of their communications, commit messages, etc. The
likelihood that producing a single GPG key and single SSH key is a large
barrier to Gentoo entry is low, especially considering we're entrusting
them to be ideologically and technically savvy. If they can't leap the
minor hurdle of producing the keys necessary to access the servers, can
they be trusted to write decent ebuilds, manage infra, or understand
enough about Gentoo to hold a vote-bearing position?

In the grand scheme of things, producing a key and asking for one to get
access isn't a big deal. Any issues with bureaucracy and recruitment is
definitely elsewhere; GPG/SSH is the easiest part.

This verification process that some have thrown around is a plus, but
not something I'd consider required unless we approve specific methods
of verification and it's not unreasonable. (For example, having a quick
video conversation and sharing the contents of their keys live, etc)

There are still pitfalls with that, too, however, because some of us may
not have constant home connections or very much bandwidth (think
dial-up). It's for that reason I'm okay with keys but against forced
verification.
-- 
Daniel Campbell - Gentoo Developer
OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6