Re: Update AB5FEB886DBB99C2

Uwe Kleine-König <[email protected]> Mon, 10 Feb 2025 18:04:19 +0100

Newsgroups	org.kernel.linux.keys
Message-ID	<jkdqvomuxu4dlejfoh6do7rwwugtm6govimv6fh2nnxbkce6lt@onerz6l45r2y>

Hello Konstantin,

On Mon, Feb 10, 2025 at 11:22:36AM -0500, Konstantin Ryabitsev wrote:
> On Mon, Feb 10, 2025 at 01:43:41PM +0100, Uwe Kleine-König wrote:
> > > > So let me ask: what type of data are actually synchronized? Is it only
> > > > the sub-keys and the expiration dates? Or is there a way to upload the
> > > > cross signatures somewhere to have them automatically synchronized in
> > > > kernel/pgpkeys.git during the periodic updates?
> > > 
> > > The keyservers can really only be relied for publishing things like:
> > > 
> > > - new subkeys
> > > - new uids
> > > - updated expiry dates
> > > 
> > > For third-party signature data it's best to send an export to this list.
> > 
> > Note that keyserver.ubuntu.com still provides 3rd-Party signatures, just
> > gpg doesn't import them by default.
> > 
> > If you really want all that stuff, use:
> > 
> > 	gpg --refresh --keyserver-options no-self-sigs-only --keyserver keyserver.ubuntu.com
> 
> Thank you for the hint! I didn't know that was needed.
> 
> However, we'll still probably only use keyservers for key updates, since if a
> key is in our keyring, that means we already have sufficient signatures and we
> just want updates to things like uids, subkeys and expiration dates.

That's true until you start to consider removing keys (because they are
expired or their crypto is week) or you also take into account
revokations. Also new signatures are good because a key that is today at
distance 3 from Linus might get nearer and so qualify to sign new keys.

Best regards
Uwe

signature.asc (application/pgp-signature, 488 B)