Re: [gentoo-project] Re: [gentoo-dev] Manifest signing

[Mr. Aaron W. Swenson]

On Thu, Sep 29, 2011 at 01:26:25PM -0400, Mike Frysinger wrote:
> On Thursday, September 29, 2011 12:48:35 Mr. Aaron W. Swenson wrote:
> Well, there's a bit more to it than that. 'repoman' must enforce the
> usage of keys or die if it can't.
>
> there's already bugs open for this.  298605 and 313601.  if you want to
> accelerate things, then chip in and update repoman.
>
> > Also, the Dev Handbook only says 'can', it needs to be changed to
> > 'must'.
>
> that is the summary of the article which describes what the page is for,
> not the policy it enforces.
>

I guess I'm getting ahead of myself. We keep referencing that page saying
"here's how you should do it", but then we shoot ourselves in the foot
saying that it isn't policy in the next breath.

> > I'd also drop the bit about expiration. Instead, I'd change it to read
> > "expires no sooner than 6 months". You know, to give the key a moment
> > to be recognized by some people, perhaps even marginally trusted by
> > someone.
>
> i'm fine with extending the length of the key.  i think last time this
> came up, so was everyone else.  the point was more disallowing keys that
> never expire.

I agree with that. The key should have an expiration. (I said something
different to Mr. Vroon not too long ago.) We don't want a trusted key
sticking around forever after a dev leaves us. It should be long enough to
not be an inconvenience. Five years is the general recommendation. I'd say
the average Gentoo Dev lifespan. (Do we even have stats on that?)

> but this doesn't stop anyone from signing their manifests today.

No, it certainly doesn't.

> > What really matters is that it is an unexpired, valid key.
>
> no, what matters is that the key is unexpired/valid at the time the
> signature was made, and not revoked after that (simply because it
> expired ... revoking because of compromise is obviously OK).

That's what I meant.

-- 
Mr. Aaron W. Swenson
Pseudonym: TitanOfOld
Gentoo Developer