[gentoo-dev] Infra notice: increasing strictness of OpenPGP checks

[gentoo-dev] Infra notice: increasing strictness of OpenPGP checks

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 846 bytes --]

Hi, everyone.

I'm working on improving OpenPGP commit verification on Infra end.
The changes so far shouldn't visibly affect developers whose accounts
are configured correctly.  However, if you have trouble pushing, please
contact me (or other Infra members) immediately to investigate.

The changes so far are:

1. We've switched to a new model for fetching and propagating keys
within Infra.  This means that your key updates should be propagated
faster now (within 2 hours + keyserver propagation time).  Hopefully,
this also means revocations will be noticed much faster.

2. We're enabling pairing keys with developers (the way gkeys is
supposed to work).  It means that gitolite will now check that the key
used to sign commits actually belongs to the developer performing
the push.

-- 
Best regards,
Michał Górny

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 963 bytes --]

Re: [gentoo-dev] Infra notice: increasing strictness of OpenPGP checks

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 1156 bytes --]

On Sat, Jul 21, 2018 at 1:50 AM, Michał Górny <mgorny@gentoo.org> wrote:

> Hi, everyone.
>
> I'm working on improving OpenPGP commit verification on Infra end.
> The changes so far shouldn't visibly affect developers whose accounts
> are configured correctly.  However, if you have trouble pushing, please
> contact me (or other Infra members) immediately to investigate.
>
> The changes so far are:
>
> 1. We've switched to a new model for fetching and propagating keys
> within Infra.  This means that your key updates should be propagated
> faster now (within 2 hours + keyserver propagation time).  Hopefully,
> this also means revocations will be noticed much faster.
>

If you lack commit access to repo/gentoo, you may have experienced issues
pushing signed commits to other repositories.
This has been fixed and your pushes should work now.

-A


>
> 2. We're enabling pairing keys with developers (the way gkeys is
> supposed to work).  It means that gitolite will now check that the key
> used to sign commits actually belongs to the developer performing
> the push.
>
> --
> Best regards,
> Michał Górny
>

[-- Attachment #2: Type: text/html, Size: 1749 bytes --]