[gentoo-nfp] Re: PGP fingerprints of Foundation members (item for Trustees meeting)

[Roy Bamford <neddyseagoon@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1491 bytes --]

On 2017.08.03 12:16, Matthew Thode wrote:
> To be clear, a list of full key IDs with verification (some sort of
> video chat maybe) of the fingerprint.  Said fingerprint would be
> recorded in git (signed commits and pushes to verify trust of the
> fingerprints).
> 
> On August 3, 2017 6:13:13 AM CDT, Ulrich Mueller <ulm@gentoo.org>
> wrote:
> >As discussed with prometheanfire in #gentoo-trustees, I am suggesting
> >the following as an item for the (September?) Trustees meeting.
> >
> >Apparently, the Foundation only has a list of PGP key IDs in
> >https://wiki.gentoo.org/wiki/Foundation:Member_List. Even worse, most
> >IDs listed there are only 32 bit IDs, providing no security at all.
> >
> >I would like to ask the Foundation to keep a list with the (160 bit)
> >PGP fingerprints of its members. (For developers, this information
> >should be readily available in LDAP.)
> >
> >Ulrich
> 
> -- 
> Sent from Kaiten Mail. Please excuse my brevity.


What do we need to prove?

That the the key belongs to a given individual or just that the key on the vote
is the same as the key used for the membership application.?

The former involves a web of trust of some sort and we don't do that for devs
joining the distro.

I suggest that the latter is suffcient but the web of trust would be nice to have.

Agreed tht the 32 bit key IDs need to be improved.
-- 
Regards,

Roy Bamford
(Neddyseagoon) a member of
elections
gentoo-ops
forum-mods

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]