Re: [gentoo-project] [RFC pre-GLEP] Identity verification via OpenPGP WoT

[Kristian Fiskerstrand]

On 3/4/19 8:06 PM, Michał Górny wrote:
> Hi,
>
> Here's a revival of WoT pre-GLEP.  I've followed the earlier
> suggestions, and rewritten it from scratch with a different perspective.

I promised to come back on the ML with some feedback on this matter, so
here we go.

Since this is a non-mandatory recommendation I question whether it makes
sense as a GLEP to begin with, as it can rather be maintained in some
other location by a project, but leaving that aside for now there are
some structural issues with the proposed GLEP.

The GLEP should outline the governance model for how a policy is set,
whom update it and what the goals of such a policy is. One of the more
important points for the GLEP would be how to use it, basically a
permanent URI to use for a policy URI in accordance with rfc4880 section
5.2.3.20. This URI needs to allow for versioning to allow for updating
in a reasonable manner. If the policy is the GLEP itself, an update will
normally be another GLEP so there is no consistency in the URIs nor an
easy blackline of the changes between policies. The first policy can of
course be attached to a GLEP, but the policy itself belongs in a
revision controlled repository to allow for changes, and updating it can
be delegated to a project set up for the purpose, possibly with with an
explicit, or likely an implisit, involvement with other projects such as
Security.

As for the policy itself; Such a policy very similar to requirements for
Certification Practice Statement (CPS) for certificate authorities as
outlined in the CAB Forum Baseline Requirements (
https://www.cabforum.org ). As an example one can look at letsencrypt's
CPS at https://letsencrypt.org/documents/isrg-cps-v2.3/.

The specific policy for instance does not specify the significance of
the various signing levels found in rfc4880 section 5.2.1. One possible
interprentation would for instance be that a 0x13 signature can be used
for a signature where the developers have met face to face, but a
digital verification is allowed to use a 0x12 signature. Either could be
allowed to use the more generic 0x10 signature type.

But the initial reaction is that this policy itself does not belong as a
GLEP, which should be focused on the structure, and the policy itself is
not ready, but a project can work on this if a project is created and
the URI is determined and linked to a tag in a git repository or the
like. A proposed alternative is
https://www.gentoo.org/openpgp-signing-policy/v1/ where v1 is mapping to
a git tag for an HTTP 302 c.f rfc2616


-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3