Messages in this thread | | | Date | Sat, 1 Oct 2011 18:52:08 -0400 | From | Ted Ts'o <> | Subject | Re: kernel.org status: establishing a PGP web of trust |
| |
On Sat, Oct 01, 2011 at 03:36:58PM -0700, Randy Dunlap wrote: > > Who needs these privacy keys? Is it just (git) users of kernel.org? > > so people who send patches via email do not need to do this process? > or are we headed into sign-all-patches territory soonish?
There is going to be discussion about security procedures at the kernel summit; to date we've been focused on the short-term requirements to get git.kernel.org back up so that the next merge window can open up, hopefully without getting instantly compromised again. That's going to require the help of everyone that we trust, especially from folks who are maintaining git repositories.
I personally don't think we're headed into sign-all-patches, since patches still need to be reviewed, and at some level, as long as the patch is reviewed to be Good Stuff, that's actually the most important thing.
That being said, if you have a GPG key, and you can participate in a key signing exercise so that you are part of the web of trust, that also means that you have a much better ability to trust that git trees that you pull down to your system that have signed tags are in fact legitimate (at least up to a signed tag).
So there are good reasons why developers who primarily participate by e-mailing patches might want to start using GPG.
- Ted
| |