Re: Finding a “good” OpenPGP key server

[Maxime Devos <maximedevos@telenet.be>]

[-- Attachment #1: Type: text/plain, Size: 2078 bytes --]

Ludovic Courtès schreef op ma 30-05-2022 om 17:34 [+0200]:
> > (package
> >    (name "gnurl")
> >    [...]
> >    (properties
> >      ;; Keys that are considered ‘trustworthy’ for signing releases
> >      ;; of gnurl.
> >      `((permitted-pgp-signing-keys "CABB A99E ..." "DEAD BEEF ...")
> >        ;; Locations of PGP key (possibly with some of them pointing
> > to
> >        ;; the same key)
> >        (pgp-key-locations
> >          ,(savannah-pgp-key USER-ID) ... ; most signers are on
> > savannah.gnu.org
> >          ,(local-file "[...]/someone.pub") ; not easily available
> > from the Web               
> >          "https://rando/key.pub"
> >          "ipfs://.../..." "gnunet://...")))) ; download key via P2P
> > networks
> > 
> > The first part (permitted-pgp-signing-keys) has been suggested
> > previously and
> > seems mostly orthogonal, but the second part is new.  It would
> > reduce
> > the dependency on central infrastructure.  We could consider key
> > servers
> > to be ‘merely’ another fallback.
> 
> We could also have our own key server.  Just like ‘guix lint -c
> archival’ triggers SWH archival, we could have a tool that triggers
> key download on the server so that crypto material never vanishes.

Is archival important here though?  If the crypto material vanishes,
presumably that means the corresponding author stopped updating the
source code, so it won't be useful anymore (except for after-the-fact
verification?).

What benefit would a Guix key server bring us?

I guess my suggestion is to skip any intermediate infrastructure and
let the Guix repo itself be the key ‘server’ (when using local-file
(*)) or download directly from the site where the key is located.

(*) if space is concern, there are some GPG options that can be used
for stripping out the photo ids and the various signatures by other
people and keep only the bits actually required by Guix.

Greetings,
Maxime.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]