[gentoo-dev-announce] Infra notice: increasing strictness of OpenPGP checks

[gentoo-dev-announce] Infra notice: increasing strictness of OpenPGP checks

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 846 bytes --]

Hi, everyone.

I'm working on improving OpenPGP commit verification on Infra end.
The changes so far shouldn't visibly affect developers whose accounts
are configured correctly.  However, if you have trouble pushing, please
contact me (or other Infra members) immediately to investigate.

The changes so far are:

1. We've switched to a new model for fetching and propagating keys
within Infra.  This means that your key updates should be propagated
faster now (within 2 hours + keyserver propagation time).  Hopefully,
this also means revocations will be noticed much faster.

2. We're enabling pairing keys with developers (the way gkeys is
supposed to work).  It means that gitolite will now check that the key
used to sign commits actually belongs to the developer performing
the push.

-- 
Best regards,
Michał Górny

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 963 bytes --]