Re: tl26 pretest start

On Mon, 23 Feb 2026, Max Chernoff wrote:
> What's wrong with the following?
> 
>     $ wget https://tug.org/texlive/public-key.txt

The same reason you mentioned in your (to be answered) email ;-)
Single point of failure.

Yes, that is a possible approach, I agree. But do we want for each tlmgr
run on this planet have a connection to tug.org?

The system as it is now is designed for full mirror usage, ability to
verify offline (download and do some company/dept internal installation,
offline media, ...).

Maybe we should offer the above as an alternative, or try it first and
fall back to local later? But what is the win?

> HTTPS than one obtained from a gpg keyserver. Plus, TLS certificates are
> replaced every 90 days, while our gpg key is over 10 years old, so the

Expiry of the signing sub-key is always RELEASE - 2 months + 16 months
(plus or minus, when I find time to do the extension before release).
So if something happens, we can revoke and create a new key.
We **could** do this every 90 days, too, but I don't want to.


Best

Norbert

--
DI Dr Norbert Preining                        https://www.preining.info
arXiv / Cornell University   +   IFMGA Guide   +   TU Wien  +  TeX Live
GPG: 0x860CDC13   fp: F7D8 A928 26E3 16A1 9FA0 ACF0 6CAC A448 860C DC13