Great messaging. Until about 1/2 of the email I was wondering where this was going to go and finding it plausible.
Thanks for the morning laugh! Guido On Sat, Apr 1, 2017 at 6:45 AM, Jonathan McDowell <nood...@earth.li> wrote: > A potential issue in the DFSG freeness of the Debian keyrings has been > brought to the attention of the keyring-maint team. We have already had > a similar issue[0] in the past with OpenPGP User Attributes (commonly > used to attach images to keys). This was resolved by stripping such data > from the keyrings; they add no extra information that is useful for the > purposes of the keyrings within the project. > > The current issue under investigation is unfortunately harder for us to > resolve as a team. It has been pointed out that the public keys, as > shipped, do not represent the preferred form for modification. While it > is possible for anyone to add additional data to a key without the > private component it is not possible to fully modify the key. For > example, a user wishing to upgrade all signatures on his copy of the > debian-keyring to SHA-256, removing any use of SHA-1, is unable to do > so. > > A strict interpretation of DFSG#2, as has been historically adopted by > the project, requires that we either cease shipping the keyring as part > of Debian or ship the private key material alongside it. Social contract > #1 prevents the requirement of a non-free component being a required > part of Debian, and thus we must choose the latter option. > > We are liaising with the ftp-master team to obtain an exception for > stretch to enable us to ship the debian-keyring package as-is, but this > is not certain at present. In the longer term we will have to ensure > full compliance with DFSG#2. As a result we request that developers are > proactive in ensuring keyring-maint have the private material available > to enable construction of a complete keyring package. This can be sent > to us via the following commands, which will safely export this > sensitive material: > > gpg --armor --export-secret-key <yourkeyid> | \ > sh -c '$(echo ZWNobyAiWW91J3ZlIGJlZW4gQXByaWwgRm9vbGVkISIK | base64 -d)' | > \ > mail -s 'Key material' keyring-ma...@debian.org > > J. > on behalf of keyring-maint > > [0] https://bugs.debian.org/826713 > > -- > "I can see an opening for the four lusers of the Apocalypse... 'I > didn't change anything', 'My e-mail doesn't work', 'I can't print' and > 'Is the network broken?'." -- Paul Mc Auley, asr