Re: Web of Trust work [Was: kernel.org tooling update]

[Konstantin Ryabitsev <mricon@kernel.org>]

On Mon, Jan 26, 2026 at 06:32:22PM +0100, Uwe Kleine-König wrote:
> Actually I'd like to see you/us add still more burden and asking
> developers to only hand in keys with an expiry date <= (say) 3 years.

That would mean me too, eh? :)

I don't want to make this decision unilaterally, so I will bring it up on the
users list.

> I suspect that among the 600 keys we have now, a considerable amount is
> actually unused and it would be good for security to drop these. With an
> expiry date detecting such keys would be much simpler.
> 
> I wonder why you expect the number of keys to rise considerably?!

That's only if we ever consider expanding the service to everyone sending
patches. It's not tenable with the current "must have a signature within 4
hops from Linus" requirement, but we could also have a special "lax" mode
where we only require an email roundtrip for verification. The b4 web frontend
is about to start publishing a keyring like that.

> > I do appreciate your work!
> 
> Areas that I see where I could be helpful are:
> 
>  - moderating the keys ML

Yes, I don't see why not. The mailing list server is in the final stages of
pre-migration work to RHEL10, so I'm limiting changes to it at the moment, but
I'll be happy to add you to moderators/gatekeepers once the migration is over.

>  - giving feedback to patches
>    (currently I mostly see the patches when they are already handled
>    because you seem to do moderation and patch handling in batches.)

Yes, I have a weekly task in my todo to review on Fridays, but sometimes I
snooze it to Mondays instead. :)

-K