Re: Commits signed by key not registered on Savannah

[David Craven <david@craven.ch>]

> Would the git repository, or a new git repository (guix-keys.git?) be a
> bad idea? Best case, we craft something which serves as an GNUPG_HOME
> for the keys which then live in the keyring of this thing (compare to
> gentoo-keys, debian-keys, etc).

I don't think that is a good idea. Placing it in the same git
repository that we are trying to verify means that if an ssh key has
been compromised, someone could add a malicious commit and a public
key - since this means that developers would be expected to manage
their own public keys in this list, it may not even be suspicious. If
someone MiM cuirass <-> savannah it would not even show in our view of
the repo.

The integrity of our source code is given by peer review - we are
subscribed to the commits ML so we see other peoples commits.

The most important thing is verifying that the substitutes come from
signed and verified commits only. Maybe keys need to be stored in the
cuirass configuration.