reduce/simplify the maintenance of sec-keys packages

Agostino Sarubbo <[email protected]> Tue, 16 Jun 2026 09:34:39 +0200
Newsgroups gmane.linux.gentoo.devel
Message-ID <6170374.MhkbZ0Pkbq@fcf>
Hello all,

right now we have 289 packages in the sec-keys directory.

I have not analyzed whether this is technically possible, but I am wondering whether it 
would make sense to create a dedicated Git repository on GitWeb, store all keys there, and 
have a single ebuild that installs all of them.

While this approach would install many keys for packages that are not present on the 
system, I think that is acceptable given that each key is only a few bytes in size.

With such a setup, whenever a new key is added we could simply create a new tag/
snapshot of the repository.

Alternatively, to simplify things even further, the sec-keys package could exist only as a live 
(9999) ebuild, eliminating almost all packaging work related to sec-keys.
Regarding this matter, we should add a way to rebuild the sec-keys package when you 
have installed it before the required key has been added. I don't know if is possible by 
looking at /var/db/pkg/*/*/BUILD_TIME

As I said before, I do not know whether this is technically possible. I am just trying to 
evaluate whether such an approach would be worthwhile and whether it would actually 
reduce the maintenance work associated with the sec-keys packages.

Agostino