Re: tl26 pretest start

On Mon, Feb 23, 2026 at 07:05:39PM +0100, Norbert Preining wrote:
> Hi Torsten,
> 
> > tlgpg alias Gpg  1.4.23 is working. However, recently there have been a number of bugs and bug fixes with gpg, see for example https://gpg.fail  and their talk at CCC.
> 
> I am aware of gpg.fail and others, but we are speaking about  very
> restrictive use here - no arbitrary keyrings, no imports of strange
> keys, ... - 
> 
> Above that, gpg2 is a PITA, because it requires a daemon running.
> gpg2 is really not for distributions like we are having here.
> 
> If you have better suggestions, I am more than happy to discuss them,
> but as far as I see there is no way to have cryptographic check **AND**
> a kind of "web of trust" to ensure that nothing has been tampered.
> 
> There are a lot of other and better tools for signing **ASSUMING** that
> we can guarantee the existence of a untempered public key. But this
> cannot be guaranteed due to the distribution network, and the only
> guarantee is a web of trust.

I get your point.  Nonetheless, could signify be an option worth
considering?  The system adopted by OpenBSD consists of providing the
public keys that will be used for the next two releases in each
release.

I raise this question because when one installs TeX Live, the script
asks whether to reuse the settings from the previous
installation. (When there is one.)

-- Robert