Re: Update of James Bottemley's key in the kernel PGP keyring

Uwe Kleine-König <[email protected]> Wed, 28 Jan 2026 14:23:07 +0100

Newsgroups	org.kernel.linux.keys
Message-ID	<wurdvn6g5jno57ab4ek2yqkvum5hpw6apbmgz3gdegrz6ktyr6@pphqxlrxbtg6>

Hello James,

On Wed, Jan 28, 2026 at 07:37:09AM -0500, James Bottomley wrote:
> On Wed, 2026-01-28 at 11:56 +0100, Uwe Kleine-König wrote:
> > recently (2026-01-16) the subkeys (as tracked in the kernel pgpkeys
> > repo) of James Bottomley's key expired. He updated the expiry date,
> > however adding the updated key to the keyring brings some trouble to
> > the WoT as an update drops SHA1 protected signatures which (among
> > others) loses the direct signature from Linus to James.
> 
> I don't think we care about historical signatures or the web of trust
> any more.  The signatures are mostly from the original key signing in
> 2011 so they'll all be sha1.  All we actually care about is people
> already in the keyring signing the keys of people who aren't but want
> to be.  That's a current not historical function.

Note however that for the model that is actually implemented it's Linus'
signatures that matter. So currently the criteria to get your key added
to the keyring is that there is at least one signature path from Linus
to you within the current keyring of length at most 5 (with counting
both Linus and you). See e.g.
https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/graphs/E4B71D5EEC39C284.svg
. A key that is only signed by Karel Zak doesn't qualify to be added.

Best regards
Uwe

signature.asc (application/pgp-signature, 488 B)