[vox] GPG Key signers?

[Timothy D Thatcher]

Hi Daniel,

Broadly speaking, a web of trust is built as people start verifying
and signing keys for each other. A short explanation of the idea can
be found at https://www.gnupg.org/gph/en/manual/x547.html or a longer
one on Wikipedia, and a number of academic papers on the topic are
available online, as well.

I'm not familiar with Debian's exact requirements for your situation,
but https://wiki.debian.org/Keysigning/Coordination says that "Having
your GPG key signed by a Debian member is the preferred way of proving
your identity in the second step of the New Maintainer process." The
site also has some ways to connect with other Debian members directly
to get verified and signed in person. There are some folks listed in
the Sacramento area that may be able to help.

https://wiki.debian.org/Keysigning has directions on the actual
process of creating, printing, verifying, signing, and uploading a
signature. It also has some directions for commands found in the
signing-party package, which can help automate the process a little
bit.

I don't have too many signatures myself, but I'm happy to bring my key
to the next club social on November 6th and sign yours, if you're
interested. I think any signatures are better than none when it comes
to building a web of trust. Hopefully some other folks will speak up
and be willing to participate, as well.

TimOn Mon, Oct 15, 2018 at 11:51 AM Daniel Sperka <djsperka at ucdavis.edu> wrote:
>
> Hi - I'm a local developer (UCD Center for Neuroscience), and am looking for someone to sign my GPG key. Trying to get a package in to debian, but my key has few sigs, and my mentor at debian cannot get a trust path back to my key.
>
> If anyone in LUGOD knows what this means and can help, I'd love to hear from you!
>
>
> --
> Daniel J. Sperka, Ph. D.
> UC Davis Center for Neuroscience
> _______________________________________________
> vox mailing list
> vox at lists.lugod.org
> http://lists.lugod.org/mailman/listinfo/vox