Re: [gentoo-project] pre-GLEP: Gentoo OpenPGP web of trust

[Kristian Fiskerstrand]

On 1/31/19 5:35 PM, Alec Warner wrote:
>
> My main problem with the GLEP is that it seems to propose a WoT for
> a WoT's sake and my question then becomes "why do we need a WoT?"
>
> As in, what does a WoT enable the project to do that it cannot do
> now?

There are multiple aspects to this, and I'm only commenting the way I
see it here.

being part of the WoT allows external parties to find a trust path to
gentoo developers, e.g when it comes to relying on communication in
various channels. This part could also be solved by infra running a
Gentoo Developer CA that signs all developers' Transferable Public Key
(TSP, aka public key).

More generally, being part of the WoT can demonstrate participation in
various developer communities. A user that is involved in various
upstream projects and familiar with them already can potentially be more
valuable as a developer for Gentoo, and can also potentially be a factor
for reduced tension between developers as they have demonstrated being
part of other communities already.

In addition comes a better certainty about the UID used for copyright in
signed-off-by, we as a distribution rely on this for both developers and
external contributors, and we need to demonstrate that we have taken
reasonable measures to ensure that what we add is unencumbered.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3