Re: PGP signing release

On Tue, 2003-02-11 at 18:27, Curt Sampson wrote:
> On Wed, 11 Feb 2003, Greg Copeland wrote:
>
> > On Wed, 2003-02-05 at 18:53, Curt Sampson wrote:
> >
> > [Re: everybody sharing a single key]
> >
> > This issue doesn't change regardless of the mechanism you pick. Anyone
> > that is signing a key must take reasonable measures to ensure the
> > protection of their key.
>
> Right. Which is why you really want to use separate keys: you can determine
> who compromised a key if it is compromised, and you can revoke one without
> having to revoke all of them.
>
> Which pretty much inevitably leads you to just having the developers use
> their own personal keys to sign the release.
>
> > Basically, you are saying:
> > You trust a core developer
> > You trust they can protect their keys
> > You trust they can properly distribute their trust
> > You don't trust a core developer with a key
>
> Not at all. I trust core developers with keys, but I see no reason to
> weaken the entire system by sharing keys when it's not necessary. Having
> each developer sign the release with his own personal key solves every
> problem you've brought up.
>
> cjs

You need to keep in mind, I've not been advocating, rather, clarifying.
The point being, having a shared key between trusted core developers is
hardly an additional risk. After all, either they can be trusted or
they can't.

At this point, I think we both understand where the other stands.
Either we agree or agree to disagree. The next step is for the
developers to adopt which path they prefer to enforce and to ensure they
have the tools and knowledge at hand to support it.

Anyone know if Tom and Bruce know each other well enough to sign each
other's keys outright, via phone, via phone and snail-mail? That would
put us off to an excellent start.

Regards,

--
Greg Copeland <greg(at)copelandconsulting(dot)net>
Copeland Computer Consulting