Christoph Anton Mitterer dijo [Fri, Jun 20, 2014 at 10:24:07PM +0200]: > > I do feel the keyring-maint package is a leftover from days long > > gone. Nowadays the keyring is kept at a DVCS tree, and regularly > > exported to a publicly accessible instance. > Any reason for that "internal" repo? I mean what speaks against the idea > of expressing everything via signatures by some special keys (which was > probably the core idea of my proposal)
We want the repo to show what is "truth" at a given point in time. If we shared our working tree, there'd be space for confusion on keys we have already changed but not yet pushed (we do so on a ~monthly basis). Also, every now and then we handle requests that need not to be made public until they have been implemented. Of course, we try to implement/push them as soon as possible, but it's better to keep them separate in a "not yet live" place. -- To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: https://lists.debian.org/20140625133327.ga64...@gwolf.org
