Re: Web of Trust work [Was: kernel.org tooling update]

[Mauro Carvalho Chehab <maurochehab@gmail.com>]

Hi Konstantin,

On Mon, 26 Jan 2026 11:23:43 -0500
Konstantin Ryabitsev <mricon@kernel.org> wrote:

> On Fri, Jan 23, 2026 at 10:12:39PM +0100, Uwe Kleine-König wrote:
> > >   - I am the bottleneck in the process, because all updates have to go through
> > >     me; even if we add more people to have access, this would still be a
> > >     bottleneck, because the more keys there are in the web of trust, the more
> > >     finagling the whole process requires to deal with expirations, key
> > >     updates, identity updates, etc. We can rely on modern keyservers for some
> > >     of it, but not for third-party signatures, which are key for our
> > >     distributed trust.  
> > 
> > Just to ensure we're talking about the same thing: This is about calling
> > a script once a week or so, check the resulting diff, commit and push,
> > right?  
> 
> This is for updates, yes, and this is mostly hands-off except final review.
> Adding new keys is usually a lot more involved, because there's frequently a
> back-and-forth required (they sent a key without any signatures, there is not
> enough signatures, the signatures are too far removed from Linus, etc). We
> currently have about 600 keys in the keyring we maintain, and we clearly can
> do a much better job like being more proactive when someone's expiry date is
> approaching. I'm worried that if we tried to maintain a keyring for several
> thousand people as opposed to several hundred, this would snowball into an
> unmaintainable mess.
> 
> > I personally am happy with PGP and I don't see the benefit of using ssh
> > keys instead. But I'm open to look at the approach that we will see in
> > February.  
> 
> Supporting ssh keys (along with minisign keys) is a Frequently Requested
> Feature (TM) -- not so much among kernel users, but among several other
> projects that use non-forge workflows.

Replacing PGP with ssh keys to push stuff at kernel.org is
welcomed, together with any mechanism to ensure the web of trust
for ssh keys, but see, the Web of Trust PGP keys are also used when we
sign git tags before asking Linus to merge:

	https://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media.git/tag/?h=media/v6.19-3

And also when we sign tags at the userspace tools we maintain. Any
alternative Web of Trust mechanism shall keep us allowing to sign
git tags with the same trust level.

At least up to git version 2.52.0, PGP is the only allowed
mechanism to sign tags.

Regards,
Mauro