Re: [gentoo-project] [RFC] OpenPGP Authority Keys to provide validity of developer/service keys

[Rich Freeman]

On Sat, Feb 23, 2019 at 2:46 AM Michał Górny <mgorny@g.o> wrote:
>
> On Tue, 2019-02-19 at 15:16 -0500, Rich Freeman wrote:
> > Also, as far as I'm aware GLEP 63 does not require an encryption key
> > at all, just a signing key.  I'm not sure if such signing-keys will be
> > signed by Gentoo under this proposal.  If not then there is nothing to
> > upload to the keyserver, and in any case it seems like the main use
> > case of this (sending encrypted email) would not apply.  Of course it
> > could still be used for verifying email signatures if we sign
> > signing-only keys.
>
> If someone really believes it's fine to have no encryption subkey just
> because the GLEP doesn't require one explicitly...  It either means that
> person is seriously lacking the technical competence, or is a horrible
> troll.  In either case, I don't believe such a person should be a Gentoo
> developer.

The reason we write policies down is so that we can follow them.

I have a signing-only key, which I think was created following some
published procedure at the time.  I see a newer wiki article on the
subject that talks about creating a Gentoo key and it mentions that
creating an encryption subkey is recommended, though it does not say
it is required (which is correct).

In any case, if we want everybody to have an encryption subkey, then
just make it part of the GLEP.  No trolling is intended, at least for
my part.

My Gentoo commit signing key is not used for anything else.  I
generate it to follow the requirements of the GLEP, and it is designed
to be throw-away so that if the GLEP changes I can just roll up a new
key anytime.  I have no need to receive encrypted email using this
key, so it isn't set up.  Decrypting mail sent to me would be a pain
since I don't use a gpg-aware MUA, so I really don't want to do
anything to encourage people to send me encrypted mail.  However, I
think I have my Gentoo email address on my regular gpg key that is
part of the strong set and it allows encryption.  It isn't in LDAP so
it wouldn't be signed using the proposed scheme.

BTW, I'll also note that the guidelines for creating keys requires
modification to gpg config vs just using command line options.  That
seems like a rather painful way of making Gentoo-specific keys.  I
think I ended up just setting up a container for Gentoo key generation
so that I could just meet whatever specific requirements are set out
and not interfere with the real world.  Maybe one of these days I'll
get around to shell-scripting the entire process so that instead of
extending key expiry I can just revoke my old key, generate a new key,
put it in LDAP, add it to my regular keyring, and update make.conf.
On a side note I will note that gpg is a bit annoying in its
interactivity when it comes to key manipulation.

-- 
Rich