Re: Web of Trust work [Was: kernel.org tooling update]

[Mauro Carvalho Chehab <mchehab+huawei@kernel.org>]

On Mon, 26 Jan 2026 18:32:22 +0100
Uwe Kleine-König <ukleinek@kernel.org> wrote:

> > > Just to ensure we're talking about the same thing: This is about calling
> > > a script once a week or so, check the resulting diff, commit and push,
> > > right?  
> > 
> > This is for updates, yes, and this is mostly hands-off except final review.
> > Adding new keys is usually a lot more involved, because there's frequently a
> > back-and-forth required (they sent a key without any signatures, there is not
> > enough signatures, the signatures are too far removed from Linus, etc). We
> > currently have about 600 keys in the keyring we maintain, and we clearly can
> > do a much better job like being more proactive when someone's expiry date is
> > approaching. I'm worried that if we tried to maintain a keyring for several
> > thousand people as opposed to several hundred, this would snowball into an
> > unmaintainable mess.  
> 
> Actually I'd like to see you/us add still more burden and asking
> developers to only hand in keys with an expiry date <= (say) 3 years.
> Something similar to what

I would love to replace my main PGP key with a new one using a strong
post-quantum algorithm[1], and then using revocable sub-keys with a
small expiry periods (3 to 5 years), but there are some technical and
logistical issues [2]:

- gpg 2.4 doesn't seem to support to support it;
- "updating to 2.5 would result in new users generating incompatible 
  LibrePGP keys" (from LWN.net post at [2]);
- a change like that would require to restore the web of trust,
  asking people to resign your certs. Not hard to do on a
  conference, but doing it remotely, the right way, is not trivial.

So, I guess we need to wait for a couple of extra gpg versions
(or alternatives) to do it at the best moment - while keeping
our old keychain in place as a fallback.

[1] Replacing with traditional crypto algorithms is probably not
    worth, as, quantum computers are becoming a reality soon.

[2] https://lwn.net/Articles/1055053/

Thanks,
Mauro