Re: [gentoo-project] Re: [gentoo-dev] Manifest signing

[Rich Freeman <rich0@gentoo.org>]

On Thu, Sep 29, 2011 at 11:11 AM, Patrick Lauer <patrick@gentoo.org> wrote:
> Otherwise some funny person will use a 4-bit key that expires tomorrow
> just to point out the missing details ...
>

<div mode=rant>
I think this is becoming a big problem with Gentoo.  There is
something to be said for planning, but I think we have a tendency to
bikeshed things to death before we do ANYTHING.

All because when somebody goes and uses a 4-bit key we feel some kind
of paralysis about taking action.  People that take obvious steps to
skirt policies should simply be disciplined.  I'm not talking about
the guy with an old 512-bit key or whatever, or people that change
after being asked nicely to do so.  When it is obvious that people are
just messing with the distro to prove a point then they are excluding
themselves from the community.

We allow ourselves to be held hostage to anybody who can find a
loophole in the rules, and that just leads to 40 bazillion rules and
refusal to move forward until we have at least 50 rules to start with.
 If a rule is stupid just say it.  If you think a council member who
voted for it is stupid, be polite but call them on it.  What we don't
do is just ignore the rules, or try to end-run them.
</div>

I'd just encourage the council to not wait for the perfect
specification to move forward with this or anything else.  I applaud
efforts like PMS and I think they add value.  However, specs/rules are
a tool to serve the community, and not enslave us.

Why not just keep this simple:
1.  Key >= 1024 bits.
2.  Validity >= 6 months.
3.  Signature readable by stable gpg in tree.

Rich