Re: [gentoo-project] GPG Keyring distribution & packages

Just checking: Brian (dol-sen), Rick (Zero_Chaos), Robin (robbat2) - are
all the issues resolved here?

Please see some quotes below for what might appear to indicate some
further changes to the GLEP. The key distribution part doesn't seem to
be fully ready, but feel free to correct me.

Thank you for working on this, I think better security there is
important for Gentoo.

By the way, one more suggestion that came up is splitting the GLEP into two:

1) individual developer key and gpg guidelines (looks like this could be
approved now)

2) distro-wide key/keyring distribution mechanism/policy (looks like it
may need more work)

Paweł

On 11/16/13, 12:43 AM, Brian Dolbec wrote:
> On Fri, 2013-11-15 at 16:25 -0500, Rick "Zero_Chaos" Farina wrote:
>> On 11/15/2013 02:37 PM, Robin H. Johnson wrote:
>>> On Fri, Nov 15, 2013 at 01:51:32PM -0500, Rick "Zero_Chaos" Farina wrote:
>>>> On 11/15/2013 01:23 AM, Robin H. Johnson wrote:
>>> There are a few parts to it:
>>> - gentoo-keys (lead by dolsen)
>>>   This is a mostly infra-level tool that takes the data in LDAP, does
>>>   validation, mixes in the keys from keyserver/homedir, and generates
>>>   keyrings.
>
> Not quite right.  The gentoo-keys project is a repository with two main
> components.
>
> 1) gkeyldap cli and python pkg.  [...]
>
> 2) gkey cli and python pkg. [...]
>  [...]
>> I think this is a great idea, BUT, we would need to handle "the latest
>> gentoo-dev-keyring" like portage updates used to be handled.  If there
>> is an update, warn the user, and if gentoo-dev-keyring is in the update
>> list it *must* be merged first.  Again, these implementation details
>> don't necessarily have to be in the glep, but we need to make sure as we
>> go through that we account for such things.  My day job is pretty much
>> running man in the middle on things and laughing at the result, so I'm
>> super excited to see all this hard work going in.
>> [...]
>>> TODO:
>>> We need a way for a given repo, once installed, to specify what keyrings
>>> to use for validation. I'm thinking of adding it to
>>> metadata/layout.conf.
>>> The main gentoo-x86 repo would have for example:
>>> keyrings = gentoo-master gentoo-releng gentoo-dev
>>>
>>> Overlays might have:
>>> keyrings = gentoo-overlay-mysql
>>>
>> Love it.  This should probably make it into the glep.
>>
> Sounds good to me.
>
> P.S.  OH my, this turned out to be along reply :/
> But I hope it clears up any questions people may have about it.
> It is a work in progress...