Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?

[Andrew Savchenko]

On Wed, 4 Jan 2017 18:58:26 +0100 Kristian Fiskerstrand wrote:
> With increasing focus on security in various contexts I'd like to
> propose that we start discussing catching up with other distributions
> and start requiring new developers' OpenPGP keyblocks to have at least
> two signatures from existing developers before applications can be
> made[A]. Amongst other things This helps building the Gentoo Web of Trust.
>
>
> E.g [Debian] has the following requirement: "To maintain the strong Web
> of Trust that connects all Debian Developers, Applicants need to
> identify themselves by providing an OpenPGP key that is signed by at
> least two official Developers. To further ensure their identity,
> signatures by other people (who do not need to be DDs, but should be
> well connected in the overall Web of Trust) are strongly recommended."
>
>
> References:
>
> [Debian] https://www.debian.org/devel/join/nm-checklist
>
>
> Endnotes:
>
> [A] Possibly with an opt-out by application to council, in case there
> are certain regions where this is considered non-feasable etc.
>

This will be next to impossible for many candidates. What about
people who don't have Gentoo devs nearby? They have to flight
(probably to some event) to meet them. What if this is too
expensive for them, or they can't leave their country due to
various reasons, or they just don't have time slot to visit
particular event?

Frankly, with such requirement I could not have become developer
myself back then in 2014.

And what about anonymous developers? We do have them and in modern
world people may have good reasons to stay anonymous. Just reminds
me about US braindead law allowing company to own all code written
by dev, while he/she is employed, even when that code was written
using during off-duty hours or vacation days.

Best regards,
Andrew Savchenko