Re: tl26 pretest start

Hi Norbert,

On Tue, 2026-02-24 at 00:20 +0100, Norbert Preining wrote:
> On Mon, 23 Feb 2026, Max Chernoff wrote:
> > What's wrong with the following?
> >
> >     $ wget https://tug.org/texlive/public-key.txt
>
> The same reason you mentioned in your (to be answered) email ;-)
> Single point of failure.

The current page

    https://tug.org/texlive/verify.html

says that "keys.openpgp.org" and "keyserver.ubuntu.com" are the only
known working keyservers. To me, a single point of failure that we
control isn't obviously worse than 2 points of failure that we don't.

> Yes, that is a possible approach, I agree. But do we want for each tlmgr
> run on this planet have a connection to tug.org?

Well, that would only ever be required to verify the installer itself,
since after then, the public key would be verified, so we could use it
to sign everything else.

And we would never want to recommend this, but users could choose to get
the public key from a different site that they choose, as long as
they're sure that they trust it. Not a good idea in general, but it
would work well for things like large corporate/government institutions.

> > HTTPS than one obtained from a gpg keyserver. Plus, TLS certificates are
> > replaced every 90 days, while our gpg key is over 10 years old, so the
>
> Expiry of the signing sub-key is always RELEASE - 2 months + 16 months
> (plus or minus, when I find time to do the extension before release).

Ah, I wasn't aware of this, sorry. Disregard that point entirely then.

Thanks,
-- Max