Re: Web of Trust work [Was: kernel.org tooling update]

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Jan 23, 2026 at 01:24:49PM +0100, Mauro Carvalho Chehab wrote:
> On Fri, 23 Jan 2026 12:58:48 +0100
> Greg KH <gregkh@linuxfoundation.org> wrote:
> 
> > On Fri, Jan 23, 2026 at 12:47:00PM +0100, Mauro Carvalho Chehab wrote:
> > > On Fri, 23 Jan 2026 10:29:28 +0100
> > > Greg KH <gregkh@linuxfoundation.org> wrote:
> > >   
> > > > On Fri, Jan 23, 2026 at 10:19:56AM +0100, Uwe Kleine-König wrote:  
> > > > > Hello Konstantin,
> > > > > 
> > > > > On 12/10/25 05:48, Konstantin Ryabitsev wrote:    
> > > > > > ## Web of Trust work
> > > > > > 
> > > > > > There is an ongoing work to replace our home-grown web of trust solution (that
> > > > > > does work but has important bottlenecks and scaling limitations) with
> > > > > > something both more distributed and easier to maintain. We're working with
> > > > > > OpenSSF to design the framework and I hope to present it to the community in
> > > > > > the next few months.    
> > > > > 
> > > > > the current home-grown solution is https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/, right?
> > > > > 
> > > > > I wonder what the bottlenecks and scaling limitations are that you mention.
> > > > > 
> > > > > Is there some info available already now about the path you (and OpenSSF) intend to propose?    
> > > > 
> > > > There will be a presentation about this in February at a conference and
> > > > hopefully it will be made public then as the work is still ongoing.  
> > > 
> > > I got curious when I saw something about "First Person credentials"
> > > at https://lfms26.sched.com/event/2ETT5?iframe=no that 
> > > "would begin with the Linux Kernel project" - and more importantly
> > > how and when it would affect my duties. I guess I'd need to
> > > refrain my curiosity until the end of Feb :-)  
> > 
> > Ideally it will not affect anything, just replace the use of gpg however
> > you use it today for kernel work.
> 
> I suspect that, at some point, we'll need to setup our new
> credentials somehow - hopefully without needing to be physically 
> present on a gpg-like key party. If we can do that using our
> existing infra or our current gpg keys, the replacement should be 
> easy.

Yes, we will have to "recreate" the web-of-trust somehow.  That's part
of their proposal, for how to do that and maintain it over time.

thanks,

greg k-h