Re: PGP keysigning at LPC/OSSE 2026

["Uwe Kleine-König" <u.kleine-koenig@baylibre.com>]

[-- Attachment #1: Type: text/plain, Size: 2806 bytes --]

Hello,

On Mon, Oct 12, 2026 at 06:55:43PM +0200, Krzysztof Kozlowski wrote:
> On 12/10/2026 18:15, Nicolas Schier wrote:
> > On Mon, Oct 12, 2026 at 06:05:46AM -0400, Brian Masney wrote:
> >> On Sat, Oct 10, 2026 at 05:31:55PM +0200, Uwe Kleine-König wrote:
> >>> On Sun, Sep 27, 2026 at 02:33:22PM +0200, Uwe Kleine-König wrote:
> >>>> For the procedure to actually sign the certificates, see
> >>>> https://baylibre.com/blog/pgp-keysigning-2/. A bundle of all
> > 
> > before too many of you are struggling with uploading the own key with
> > the new signatures as I did, here is what worked for me on Debian:
> > 
> >   gpg --keyserver keyserver.ubuntu.com --keyserver-options no-self-sigs-only --send-key KEYID

For sending you don't need `--keyserver-options no-self-sigs-only`, it's
only needed for importing. (If after sending the newly added signatures
don't appear immediately when you do 

	gpg --recv-keys --keyserver keyserver.ubuntu.com --keyserver-options no-self-sigs-only $keyid

or check the webif that's because there is some delay until sent
certificates are available for fetching, and because there are (at least)
two servers behind that DNS name and you might hit different ones for
sending and receiving. Eventually they sync up, but that takes a bit.)

> No one syncs (and no one should) with ubuntu keyserver, so this solves
> nothing.

That's where I get the updated keys from to update the signature
graph[1] and the strong set statistic[2]. However I don't fetch into my
private keyring, but a temporary one and review the changes before
feeding them back into my local data source.

> I know Konstantin sometimes polls from them, but that's rather
> workaround not a solution.

Konstantin doesn't use `--keyserver-options no-self-sigs-only` and so
doesn't suffer from the problems that (some) keyservers create.

IMHO the best option you have to distribute 3rd party signatures is a
WKD[3]. It's not that hard to setup, and for the @kernel.org UIDs
Konstantin handles that (fed from the kernel keyring repo).
You can fetch updates from it using e.g.

	gpg --locate-external-key gregkh@kernel.org

.

To create a WKD the following is enough:

	gpg --list-options show-only-fpr-mbox -k | awk "\$2 ~ /@example.com/" | /usr/lib/gnupg/gpg-wks-client -C "$docroot/.well-known/openpgpkey/" -v --install-key

with $docroot then being served at https://openpgpkey.example.com/ .

> For people within the keyring, please send the update to the keyring (or
> Uwe will do it for you).

Uwe will do it with the updates he fetches from keyserver.ubuntu.com :-D

Best regards
Uwe

[1] https://openpgpkey.baylibre.com/Fei9keem/signature.svg
[2] https://openpgpkey.baylibre.com/Fei9keem/stat.txt
[3] https://wiki.gnupg.org/WKD

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]