Re: [gentoo-dev] Finger GLEP

[Tavis Ormandy <taviso@gentoo.org>]

On Mon, Aug 11, 2003 at 09:33:14AM -0400, Kurt Lieber wrote:
> 
> The efforts we have underway with secure portage will require developers to
> have and maintain a GPG key.  It will also require them to place said key
> on a public keyserver.  
> 

Cool, problem solved.

> Well, at this point, I'm inclined to reject this GLEP and/or ask you to
> re-work it to incorporate some of the changes suggested by myself and
> others.  Specifically: 
> 

Cool, it was just a proposal.

> * Data needs to be maintained in one central repository.  

I never meant to dispute this, i have no problem with storing
information wherever you like. The .plans, .projects and .pgpkeys in my
proposal would be a means of easily distributing pgpkeys (for _NON_
portage use, eg personal keyrings, encrypting emails, verifying patches, 
etc, etc), and presenting information for interested users that would be 
up to the developer to maintain, eg status updates, project activities, etc.

> * I'm not opposed to offering fingerd as a means of data transport, as long
>   as it pulls data from the central repository mentioned above.

Well, im not so keen on that idea, although not totally opposed if your
not open to discussion on it. 

The proposal was meant as a means for a developer to easily keep some 
information that applies to them personally, and their work on any 
projects, etc. And would be entirely up to them as to the format.

> * I'd also be open to allowing devs the option of *supplementing* the
>   information available via fingerd by creating a .plan or whatever.
>   However, the core info (GPG key, name, herds info, etc.) needs to be
>   maintained in the central repository.

This is essentially what i was proposing.

> Basically, I see the benefits of offering fingerd as a service to our users
> and am willing to support that, infrastructure-wise.  

Excellent!

> I do not agree, however, that fingerd should be the *primary* method of distributing this
> info.

I totally agree, and would not have proposed this.

> nor do I support the idea of storing critical information such as GPG
> keys in developer home dirs -- at least not as the primary "official"
> repository.

well, if by primary repository you mean where secure portage will obtain
the keys from, i dont mind that at all. The finger server in my proposal
would be for the benfit of users, and other developers, not a means of
implementing the improvements to portage.

-- 
-------------------------------------
taviso@sdf.lonestar.org | finger me for my gpg key.
-------------------------------------------------------

--
gentoo-dev@gentoo.org mailing list