Re: [PATCH] SECURITY.md: add lautrbach@redhat.com gpg fingerprint

[Petr Lautrbach <lautrbach@redhat.com>]

Paul Moore <paul@paul-moore.com> writes:

> On Thu, Jan 15, 2026 at 3:01 AM Petr Lautrbach <lautrbach@redhat.com> wrote:
>>
>> "68D2 1823 342A 1368 3AEB  3E4E FB4C 685B 5DC1 C13E" is not a subkey.
>
> Okay, in this case you need to get this new key signed by other
> individuals trusted by the SELinux community before we can consider
> including it in the SECURITY.md file.
>

My idea was:

Before this patch my address was there without gpg fingerprint. It means
that I could be contacted directly via un-encrypted email.

The key I used in this patch was already used for SELinux userspace
release, public key is available at 2 different locations connected to
me - github (I'm part of SELinux organization) and
plautrba.fedorapeople.org (I'm a packager for 15+ years) and it's also
used in Fedora [1] and RHEL [2] - only Red Hat employees can push there and it
was me who pushed [3]. That being said I expected that the key is
already trusted due to all the records.


But I see your point. I'll send another patch which will remove my address from SECURITY.md
and when the key is signed, I'll return it back.


[1] https://src.fedoraproject.org/rpms/policycoreutils/blob/rawhide/f/bachradsusi.gpg
[2] https://gitlab.com/redhat/centos-stream/rpms/policycoreutils/-/blob/c10s/bachradsusi.gpg?ref_type=heads
[3] https://gitlab.com/redhat/centos-stream/rpms/policycoreutils/-/commit/02af42ef7ea24c279708ea83cc2698b738bdee8c

Petr