Re: Web of Trust work [Was: kernel.org tooling update]

[Paul Moore <paul@paul-moore.com>]

On Fri, Jan 23, 2026 at 11:38 AM Konstantin Ryabitsev <mricon@kernel.org> wrote:
> On Fri, Jan 23, 2026 at 11:24:33AM -0500, James Bottomley wrote:
> > > There will be a presentation about this in February at a conference
> > > and hopefully it will be made public then as the work is still
> > > ongoing.
> >
> > Could you please stop doing this?  The Open Source norm is to release
> > early and often and long before you have stable code so you get
> > feedback incorporated *before* you're committed to something.
>
> I will provide this feedback to them when we meet in a week. It's not the LF
> itself who are writing this code, but a bunch of security devs funded by
> OpenSSF and they *are* closely working with me and Greg during the initial
> iteration to make sure that what they come up with is actually going to be
> suitable and well-received by the kernel community (like, don't write it in
> nodejs or something).
>
> So, I'd say we're doing it right -- write the initial tool based on the
> requirements provided by some key users, then release the 0.1 for broader use
> and do iterative development based on feedback.

Based on the comments above, it sounds like there have been at least
some requirements/design discussions already, were those on a public
list?  Perhaps they were and I simply missed it (always a real
possibility), but based on the other reactions in this thread I don't
believe that is the case.

I don't believe I'm alone when I say that I have a "complicated"
relationship with the LF; a large part of that is due to what I would
call a delayed transparency, of which this seems like it might be a
good example.  If the LF is sponsoring a project/effort that somehow
involves the community, why is the kickoff not public?  Why are other
community members not involved in establishing a list of requirements,
or participating in the design discussions?

-- 
paul-moore.com