Re: [PATCH] SECURITY.md: add my email address and GPG key fingerprint

[Stephen Smalley <stephen.smalley.work@gmail.com>]

On Thu, Jun 26, 2025 at 4:34 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Thu, Jun 26, 2025 at 11:58 AM Stephen Smalley
> <stephen.smalley.work@gmail.com> wrote:
> >
> > Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> > ---
> > No hurry on this so feel free to wait until after final release if you like.
> >
> >  SECURITY.md | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/SECURITY.md b/SECURITY.md
> > index 4f624f5d..2fee4927 100644
> > --- a/SECURITY.md
> > +++ b/SECURITY.md
> > @@ -33,6 +33,8 @@ the issue as quickly as possible and shorten the disclosure window.
> >    *  (GPG fingerprint) 4568 1128 449B 65F8 80C6  1797 3A84 A946 B4BA 62AE
> >  * Paul Moore, paul@paul-moore.com
> >    *  (GPG fingerprint) 7100 AADF AE6E 6E94 0D2E  0AD6 55E4 5A5A E8CA 7C8A
> > +* Stephen Smalley, stephen.smalley.work@gmail.com
> > +  *  (GPG fingerprint) 5073 3D29 EB3D 5CF7 17AB  32FE 100E 57E3 3B8B 54F2
>
> I'm not in front of my system with my full GPG setup so I can't verify
> this, but we should verify this key to ensure that it has been signed
> by others that are trusted by the SELinux project.  We want to make
> sure that Stephen's shenanigans are actually his and not some other
> Stephen ;)

Happy to confirm this in some out-of-band way, maybe at our next
project meeting. Unfortunately couldn't do it in person at LSS-NA this
year ;(

>
> >  * Jason Zaman, perfinion@gentoo.org
> >    *  (GPG fingerprint) 6319 1CE9 4183 0986 89CA  B8DB 7EF1 37EC 935B 0EAF
> >  * Steve Lawrence, slawrence@tresys.com
> > --
> > 2.49.0
>
> --
> paul-moore.com