Re: ELPA security

[Ted Zlatanov]

On Tue, 08 Jan 2013 17:46:51 -0500 Stefan Monnier <address@hidden> wrote: 

SM> I do wonder about key management, tho: the GNU ELPA key (note: not
SM> "maintainer" because the key does not belong to any human being)
SM> will not last for ever.
>> I thought the maintainers would have their own keys, and they would sign
>> a GNU ELPA "signing subkey" that's only used for releasing.

SM> I'm sufficiently unsophisticated that I don't really know what
SM> that means.  I understands keys can expire and can be revoked, but that
SM> doesn't say how the end-user will deal with such a situation.

SM> We need some way to update the signing key in a trustworthy way.

OK, I'll prepare a workflow and offer it for public review as part of
the POC.

Ted