Re: [gentoo-dev] Key policy for GPG verification [was: 2004.2 Feature Requests]

[Chris Bainbridge <C.J.Bainbridge@ed.ac.uk>]

On Friday 30 April 2004 21:23, Marius Mauch wrote:
> Ok, guess I should repeat that the most important thing for GPG signing
> (actually the missing part is verification) that's still missing is a
> key policy: where to store keys, how to check if they are trustworthy
> and so on. If we can agree on a simple and effective solution there it
> shouldn't be too difficult to implement this feature (talking about code
> here, not the tree). The last time we had a way too long thread with way
> too many details and discussions about problem scenarios, please let's
> try to avoid that.
> And to get everyone on track I'll start with a very simple proposal
> (idea stolen from Spanky IIRC), I won't say that it's really effective
> though:
> - keys are stored in a keyring and are installed by an ebuild
> - a key is trustworthy if it is in that keyring
> - expiration is handled by removing the key from that keyring
> - each modification to the keyring involves a version bump on the ebuild
> That's about the easiest for implementation and doesn't require anything
> new for our infrastructure or key-signing-sessions. It does not say who
> will manage that keyring though as that is not important for the
> implementation. I'm pretty sure that the idea has a number of flaws, but
> we have to start somewhere.
>
> Marius

Uh oh.. this again ;-) 

The above proposal doesn't allow recovery from a compromise, since someone 
could update the new keys ebuild to a new one containing only their key. The 
master key / monthly signing multi-server keys proposal was better. See the 
archives for details.

--
gentoo-dev@gentoo.org mailing list