Re: Web of Trust work [Was: kernel.org tooling update]

Konstantin Ryabitsev
2026-01-23T18:23:59Z

On Fri, Jan 23, 2026 at 12:23:09PM -0500, James Bottomley wrote:
> > > Could you please stop doing this?  The Open Source norm is to
> > > release early and often and long before you have stable code so you
> > > get feedback incorporated *before* you're committed to something.
> >
> > I'm not doing anything here, sorry.
>
> You're listed as a presenter on the session Mauro pointed to. And
> you're the only kernel developer on it, so I was presuming you were
> helping them out with kernel requirements.

They are primarily working with me, and just so it's clear -- this is not
any kind of assured thing. Here's where things stand:

- they asked us how we currently do our trust framework and I described the
process and its drawbacks, which are real:

- I am the bottleneck in the process, because all updates have to go through
me; even if we add more people to have access, this would still be a
bottleneck, because the more keys there are in the web of trust, the more
finagling the whole process requires to deal with expirations, key
updates, identity updates, etc. We can rely on modern keyservers for some
of it, but not for third-party signatures, which are key for our
distributed trust.
- We can't reasonably expand this to all kernel developers (not just
maintainers), because of constant churn of people coming, going, taking
breaks, etc. Maintaining the web of trust consisting of thousands of keys,
as opposed to hundreds, would become a full-time job if we stick to how
it's currently done (via the git repo and manual verification on my part
for all key additions).
- We're limited to PGP only, but it would be nice to also support something
like fido2 ssh key signatures.

- they said they could come up with something that would use self-sovereign
did's that would allow scaling the trust framework to all kernel developers
and be self-sustaining and verifiable via cross-signatures.

- I said: sure, come up with some code and let's see, as long as the following
is assured:

- It's opt-in; anyone who is happy using GnuPG can continue without any
change
- We're not forcing a complete rekeying or resigning of all keys
- There is no central service that must be up and accessible for the tools
to work
- It's not written in some esoteric framework that requires curl | bash
every 2 weeks to get the latest version

- I also made it very clear that the kernel community will have the final say
in whether this is adopted or not.

This is pretty much where we stand.

-K