Re: [gentoo-project] Re: [gentoo-dev] Manifest signing

["Anthony G. Basile" <blueness@gentoo.org>]

On 09/29/2011 12:23 PM, Mike Frysinger wrote:
> On Thursday, September 29, 2011 11:11:59 Patrick Lauer wrote:
>> On 09/29/11 17:04, Tony "Chainsaw" Vroon wrote:
>>> On 29/09/11 16:02, Anthony G. Basile wrote:
>>>> Is there any chance that we can agree to reject
>>>> unsigned manifests?  Possibly a question for the Council to adjudicate?
>>> I am happy to back a mandatory signing policy for the main gentoo-x86
>>> tree. This is a simple yes or no question that the council can vote on.
>> As previously discussed it would be nice to have some basic key policies
>> in place for that - they can be changed at any later time, but for now
>> we could agree on basic parameters like, say -
>>
>> at least 1024bit key length
>> at least 6 months validity from creation
>> one or more algorithms (initially DSA signatures and SHA1 hashing)
> there's nothing to decide as it was already outlined long ago in the docs:
> http://www.gentoo.org/proj/en/devrel/handbook/handbook.xml?part=2&chap=6
>
> if you want to *refine* that, then that's a different issue.  but the devs 
> already have all the info they need to start signing now.
> -mike

Thanks I didn't know that had made it to the devmanual.  I drop my
original request.

I guess the next step, if we were to take it, would be to have infra
enforce the policy automatically if a commit comes in which isn't signed.

-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 8040 5A4D 8709 21B1 1A88  33CE 979C AF40 D045 5535
GnuPG ID  : D0455535