Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?

[Aaron W. Swenson]

On 2017-01-06 19:39, Mart Raudsepp wrote:
> Ühel kenal päeval, R, 06.01.2017 kell 11:30, kirjutas Yury German:
> > OK we can do all of that. 
> >
> > Would a notary document verifying the person that is Mailed to a
> > party (pick an address and a responsible person), be enough to
> > authenticate the person for the original GPG Web of Trust? In my
> > opinion if lets say I was the one receiving the document that has be
> > signed by a notary public, with a GPG key fingerprint on that form,
> > and a photo verification by the Notary (Legally binding document).
> > Then I would say that they are who they say they are.
> >
> > Any opinions?
>
> This is just insane. We already suffer with unwillingness of people to
> become a developer with all the process involved. Until these are
> resolved, throwing more in is just unacceptable. Period.

Insane is a bit far, but it would be an unreasonable requirement to
become a Gentoo Developer.

Further, I’ve never seen any key signing policy that allowed
identification via notary. They’ve never specifically forbade it, but
they’ve explicitly stated that the verification must take place in
person.

> > Just an FYI on the cost. In most places a Notary Public is free at
> > the bank (In US), or a cost of $5 or under. Not sure about other
> > countries though. We do not want to make this cost prohibitive.
>
> The procedure or cost should not exist, or reimbursed with time cost as
> well.
>
> But lets not go crazy here with the bureaucracy, Ok?
>
> You don't need to know who I am, you are not getting my copyright
> assignment anyways. But you are getting my contributions under an open
> source license. Lets have more people willing to do so, not throw in
> hurdles.
>

Well, we should sort of know who you are. But, I think
contributions are identification enough. We are more concerned about
character, after all…right?