all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Tanguy LE CARROUR <tanguy@bioneland.org>
To: "Ludovic Courtès" <ludo@gnu.org>,
	"Maxime Devos" <maximedevos@telenet.be>
Cc: guix-devel@gnu.org
Subject: Re: Finding a “good” OpenPGP key server
Date: Tue, 31 May 2022 09:55:57 +0200	[thread overview]
Message-ID: <165398375752.9053.13567198847288930321@localhost> (raw)
In-Reply-To: <87czfv2fvw.fsf@gnu.org>

Hi Ludo’,


Quoting Ludovic Courtès (2022-05-30 17:34:43)
> Maxime Devos <maximedevos@telenet.be> skribis:
> 
> > Ludovic Courtès schreef op ma 18-04-2022 om 22:24 [+0200]:
> >> [... guix refresh -u stuff failing due to not finding the key ...]
> >> I’m not sure what a good solution is (other than looking for the key
> >> manually on Savannah or on some random key server).
> >
> > Alternatively, why use key servers at all?  WDYT of something like
> >
> > (package
> >   (name "gnurl")
> >   [...]
> >   (properties
> >     ;; Keys that are considered ‘trustworthy’ for signing releases
> >     ;; of gnurl.
> >     `((permitted-pgp-signing-keys "CABB A99E ..." "DEAD BEEF ...")
> >       ;; Locations of PGP key (possibly with some of them pointing to
> >       ;; the same key)
> >       (pgp-key-locations
> >         ,(savannah-pgp-key USER-ID) ... ; most signers are on savannah.gnu.org
> >         ,(local-file "[...]/someone.pub") ; not easily available from the Web               
> >         "https://rando/key.pub"
> >         "ipfs://.../..." "gnunet://...")))) ; download key via P2P networks
> >
> > The first part (permitted-pgp-signing-keys) has been suggested previously and
> > seems mostly orthogonal, but the second part is new.  It would reduce
> > the dependency on central infrastructure.  We could consider key servers
> > to be ‘merely’ another fallback.
> 
> We could also have our own key server.  Just like ‘guix lint -c
> archival’ triggers SWH archival, we could have a tool that triggers key
> download on the server so that crypto material never vanishes.

That would be a solution, I guess. But what would be the cost of setting
it up and maintaining it?
Is gnurl the only package with this problem or is it something that happens often?!

Regards,

-- 
Tanguy


  reply	other threads:[~2022-05-31  7:57 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-11  8:17 Error updating gnurl Tanguy LE CARROUR
2022-04-18 20:24 ` Finding a “good” OpenPGP key server Ludovic Courtès
2022-04-21 17:15   ` Tanguy LE CARROUR
2022-04-28  7:35     ` Ludovic Courtès
2022-04-29 19:11   ` Philip McGrath
2022-05-02  7:21     ` Tanguy LE CARROUR
2022-05-23 14:43       ` Ludovic Courtès
2022-05-23 16:19   ` Maxime Devos
2022-05-30 15:34     ` Ludovic Courtès
2022-05-31  7:55       ` Tanguy LE CARROUR [this message]
2022-05-31  8:44       ` Maxime Devos
2022-06-01 16:31         ` Ludovic Courtès
2022-05-31 15:09       ` Vagrant Cascadian
2022-05-31 17:44         ` zimoun
2022-06-01 16:32         ` Ludovic Courtès

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=165398375752.9053.13567198847288930321@localhost \
    --to=tanguy@bioneland.org \
    --cc=guix-devel@gnu.org \
    --cc=ludo@gnu.org \
    --cc=maximedevos@telenet.be \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.